c7f7f82e400ef45e56bb439a7e4335fe2d157dfcf5e747396e392f97e11b759d

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 02:30

Target
2026-06-27_d5474f2bb45ce9a4b59b94bb11248e5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 14.9MB
Sample260629-czebmsct9r
SHA256 c7f7f82e400ef45e56bb439a7e4335fe2d157dfcf5e747396e392f97e11b759d
MD5 d5474f2bb45ce9a4b59b94bb11248e5d
SHA1 2b83a075dd28225a5bdccc104edb6df63bee1c84
SHA512 60bd3bf11c6b54b1de6c1e9fa65047854f0e7af14f38880be42e6db204b2ba4cd89fd5a56e378c190201c84c61edb0487eedebf635a73cfdc0cffd2f1b47a88d
SSDEEP 98304:azFxw4EP0rkZe21OlrxhhBt+xLumvBh8huTj9E:ajNUeJln
TLSH
T146F64A53ECA525A9D0EFD1B6CA3795137AB13C880B2063D32B50F6252F77BD06AB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

Detects PowerShell content designed to retrieve passwords from host 1 IoCs

resource	yara_rule
behavioral2/memory/4996-0-0x00007FF71DC60000-0x00007FF7206FE000-memory.dmp	INDICATOR_SUSPICIOUS_PWSH_PasswordCredential_RetrievePassword

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
behavioral2/memory/4996-0-0x00007FF71DC60000-0x00007FF7206FE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DiscordURL

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/memory/4996-0-0x00007FF71DC60000-0x00007FF7206FE000-memory.dmp	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4996-0-0x00007FF71DC60000-0x00007FF7206FE000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\2026-06-27_d5474f2bb45ce9a4b59b94bb11248e5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_d5474f2bb45ce9a4b59b94bb11248e5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
PID:4996