Analysis
- max time kernel
148s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/06/2026, 00:59
Behavioral task
behavioral1
Sample
2026-06-03_0d4ac43889c7d640d3326ca6d115c343_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-03_0d4ac43889c7d640d3326ca6d115c343_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-06-03_0d4ac43889c7d640d3326ca6d115c343_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 44.5MB
- Sample260603-bb4e7ag17n
- SHA256 3427e18774a746f54b825e2627d0edb71b07422f9817a3a4cd954c671fc9b6cf
- MD5 0d4ac43889c7d640d3326ca6d115c343
- SHA1 1be466752f1ae4ee1ec5b08dc117277d2429b486
- SHA512 652614e864998f6fe634f0b1538bf490fb11159569f22eaa1063e9150c629c719de7355b4e7d2eef7a58c3cd1b36f1012ba18f2be154d206918f7be488c82ed1
- SSDEEP 196608:PLwXfxvs5DBWwm/Q9tPnhESJsYssxImk:P8XfebWwYQ7PhEg
- TLSH T100A79D1BECA545A9C5BEC13185769613BB727C485B3033D72B90F6282F77BD0AAB9310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 19 IoCs
resource yara_rule behavioral2/memory/5868-0-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/files/0x001a00000002b5e9-3.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5208-7-0x00007FF7EEE40000-0x00007FF7F1AC7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5208-42-0x00007FF7EEE40000-0x00007FF7F1AC7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5868-43-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5868-44-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5868-45-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5868-46-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5868-47-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5868-48-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5868-49-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5868-50-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5868-51-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5868-52-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5868-53-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5868-54-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5868-55-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5868-56-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5868-57-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - UPX dump on OEP (original entry point) 19 IoCs
resource yara_rule behavioral2/memory/5868-0-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp UPX behavioral2/files/0x001a00000002b5e9-3.dat UPX behavioral2/memory/5208-7-0x00007FF7EEE40000-0x00007FF7F1AC7000-memory.dmp UPX behavioral2/memory/5208-42-0x00007FF7EEE40000-0x00007FF7F1AC7000-memory.dmp UPX behavioral2/memory/5868-43-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp UPX behavioral2/memory/5868-44-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp UPX behavioral2/memory/5868-45-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp UPX behavioral2/memory/5868-46-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp UPX behavioral2/memory/5868-47-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp UPX behavioral2/memory/5868-48-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp UPX behavioral2/memory/5868-49-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp UPX behavioral2/memory/5868-50-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp UPX behavioral2/memory/5868-51-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp UPX behavioral2/memory/5868-52-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp UPX behavioral2/memory/5868-53-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp UPX behavioral2/memory/5868-54-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp UPX behavioral2/memory/5868-55-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp UPX behavioral2/memory/5868-56-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp UPX behavioral2/memory/5868-57-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp UPX - Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 5300 powershell.exe 4052 powershell.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-582348399.tmp 2026-06-03_0d4ac43889c7d640d3326ca6d115c343_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-1179503980.tmp ovd_2be21d9cad88.exe - Executes dropped EXE 1 IoCs
pid Process 5208 ovd_2be21d9cad88.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-89903a74 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_2be21d9cad88.exe\"" 2026-06-03_0d4ac43889c7d640d3326ca6d115c343_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-89903a74 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_2be21d9cad88.exe\"" ovd_2be21d9cad88.exe -
resource yara_rule behavioral2/memory/5868-0-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp upx behavioral2/files/0x001a00000002b5e9-3.dat upx behavioral2/memory/5208-7-0x00007FF7EEE40000-0x00007FF7F1AC7000-memory.dmp upx behavioral2/memory/5208-42-0x00007FF7EEE40000-0x00007FF7F1AC7000-memory.dmp upx behavioral2/memory/5868-43-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp upx behavioral2/memory/5868-44-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp upx behavioral2/memory/5868-45-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp upx behavioral2/memory/5868-46-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp upx behavioral2/memory/5868-47-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp upx behavioral2/memory/5868-48-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp upx behavioral2/memory/5868-49-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp upx behavioral2/memory/5868-50-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp upx behavioral2/memory/5868-51-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp upx behavioral2/memory/5868-52-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp upx behavioral2/memory/5868-53-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp upx behavioral2/memory/5868-54-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp upx behavioral2/memory/5868-55-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp upx behavioral2/memory/5868-56-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp upx behavioral2/memory/5868-57-0x00007FF686F30000-0x00007FF689BB7000-memory.dmp upx - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2026-06-03_0d4ac43889c7d640d3326ca6d115c343_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-06-03_0d4ac43889c7d640d3326ca6d115c343_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5300 powershell.exe 5300 powershell.exe 4052 powershell.exe 4052 powershell.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5868 2026-06-03_0d4ac43889c7d640d3326ca6d115c343_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5300 powershell.exe Token: SeIncreaseQuotaPrivilege 5300 powershell.exe Token: SeSecurityPrivilege 5300 powershell.exe Token: SeTakeOwnershipPrivilege 5300 powershell.exe Token: SeLoadDriverPrivilege 5300 powershell.exe Token: SeSystemProfilePrivilege 5300 powershell.exe Token: SeSystemtimePrivilege 5300 powershell.exe Token: SeProfSingleProcessPrivilege 5300 powershell.exe Token: SeIncBasePriorityPrivilege 5300 powershell.exe Token: SeCreatePagefilePrivilege 5300 powershell.exe Token: SeBackupPrivilege 5300 powershell.exe Token: SeRestorePrivilege 5300 powershell.exe Token: SeShutdownPrivilege 5300 powershell.exe Token: SeDebugPrivilege 5300 powershell.exe Token: SeSystemEnvironmentPrivilege 5300 powershell.exe Token: SeRemoteShutdownPrivilege 5300 powershell.exe Token: SeUndockPrivilege 5300 powershell.exe Token: SeManageVolumePrivilege 5300 powershell.exe Token: 33 5300 powershell.exe Token: 34 5300 powershell.exe Token: 35 5300 powershell.exe Token: 36 5300 powershell.exe Token: SeIncreaseQuotaPrivilege 5300 powershell.exe Token: SeSecurityPrivilege 5300 powershell.exe Token: SeTakeOwnershipPrivilege 5300 powershell.exe Token: SeLoadDriverPrivilege 5300 powershell.exe Token: SeSystemProfilePrivilege 5300 powershell.exe Token: SeSystemtimePrivilege 5300 powershell.exe Token: SeProfSingleProcessPrivilege 5300 powershell.exe Token: SeIncBasePriorityPrivilege 5300 powershell.exe Token: SeCreatePagefilePrivilege 5300 powershell.exe Token: SeBackupPrivilege 5300 powershell.exe Token: SeRestorePrivilege 5300 powershell.exe Token: SeShutdownPrivilege 5300 powershell.exe Token: SeDebugPrivilege 5300 powershell.exe Token: SeSystemEnvironmentPrivilege 5300 powershell.exe Token: SeRemoteShutdownPrivilege 5300 powershell.exe Token: SeUndockPrivilege 5300 powershell.exe Token: SeManageVolumePrivilege 5300 powershell.exe Token: 33 5300 powershell.exe Token: 34 5300 powershell.exe Token: 35 5300 powershell.exe Token: 36 5300 powershell.exe Token: SeIncreaseQuotaPrivilege 5300 powershell.exe Token: SeSecurityPrivilege 5300 powershell.exe Token: SeTakeOwnershipPrivilege 5300 powershell.exe Token: SeLoadDriverPrivilege 5300 powershell.exe Token: SeSystemProfilePrivilege 5300 powershell.exe Token: SeSystemtimePrivilege 5300 powershell.exe Token: SeProfSingleProcessPrivilege 5300 powershell.exe Token: SeIncBasePriorityPrivilege 5300 powershell.exe Token: SeCreatePagefilePrivilege 5300 powershell.exe Token: SeBackupPrivilege 5300 powershell.exe Token: SeRestorePrivilege 5300 powershell.exe Token: SeShutdownPrivilege 5300 powershell.exe Token: SeDebugPrivilege 5300 powershell.exe Token: SeSystemEnvironmentPrivilege 5300 powershell.exe Token: SeRemoteShutdownPrivilege 5300 powershell.exe Token: SeUndockPrivilege 5300 powershell.exe Token: SeManageVolumePrivilege 5300 powershell.exe Token: 33 5300 powershell.exe Token: 34 5300 powershell.exe Token: 35 5300 powershell.exe Token: 36 5300 powershell.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5208 wrote to memory of 5300 5208 ovd_2be21d9cad88.exe 82 PID 5208 wrote to memory of 4052 5208 ovd_2be21d9cad88.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-03_0d4ac43889c7d640d3326ca6d115c343_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-03_0d4ac43889c7d640d3326ca6d115c343_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:5868
-
C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_2be21d9cad88.exe"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_2be21d9cad88.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_2be21d9cad88.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_fab4632e' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5300
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'ovd_ffab4632e'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'ovd_cfab4632e'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_2be21d9cad88.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='ovd_ffab4632e'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='ovd_cfab4632e'\"; $null = $b.Put()"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4052
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 3fc98f1a0dd73c0067a28034a6d84e86b27418d68cc2fdf26345be6f4217dcf1
- MD5 9f3107a91c0a75eb75418f89fe7dcbcd
- SHA1 4538595145969d10d68c8d5fd73d51a58cde93d4
- SHA512 12506d31fba03a505c3921876135d8b9cd5fd3659c5c97b2158001ab788f0f9dcff055e95be1bd33583098848efd1036d05c0b6e23d7191b02b444a37d0dbf2c
- TLSH T1F381CD323375A0D4C9563F07192C19C463AF4396EA58AF4CB658620EE92B54BDB222F7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 3c5f1a1d451fc29973ee97f0ad89a7e22f7b41392791b711abaff3ad9848eef8
- MD5 13a32526b1815e17bef633af1593f806
- SHA1 3c75768bccbcddf989cafd828e94a34c73c9321d
- SHA512 a1b35c9ec6f9222def3a76ef5ea4e25a66015596ac52406bd41a8270717c1835b7f8eb3584b8c08479ec6eac89c8682e31e5c2b2102efc483a3ea7853c064fbe
- TLSH T14A216833B3ECC1A5C8D9117A2088AD00B2B6C3C7449E8FCB7A84C519957F5DADB541A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_amjnkysz.nvr.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_2be21d9cad88.exe
- Size 44.5MB
- SHA256 3427e18774a746f54b825e2627d0edb71b07422f9817a3a4cd954c671fc9b6cf
- MD5 0d4ac43889c7d640d3326ca6d115c343
- SHA1 1be466752f1ae4ee1ec5b08dc117277d2429b486
- SHA512 652614e864998f6fe634f0b1538bf490fb11159569f22eaa1063e9150c629c719de7355b4e7d2eef7a58c3cd1b36f1012ba18f2be154d206918f7be488c82ed1
- SSDEEP 196608:PLwXfxvs5DBWwm/Q9tPnhESJsYssxImk:P8XfebWwYQ7PhEg
- TLSH T100A79D1BECA545A9C5BEC13185769613BB727C485B3033D72B90F6282F77BD0AAB9310
- MD5 SHA1 SHA512 SSDEEP TLSH