Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/06/2026, 02:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 8.3MB
- Sample260630-c5f3escz21
- SHA256 58d8b2935bd6ea13729e4c32adc892dfb00ff56112d0a30559c4397772ae9bf0
- MD5 dc382b92defa7150b0cd4b3ca5752859
- SHA1 98938b5da67cd08ff7e5848bb1d51392226063ec
- SHA512 c6c180a3bbde3f98418984a21a6b383d9d62ae0cdeddafaab69a1669a8ebad97e36eb5aec7317b462aee5ebf1ed785029f9655e5a686d4d3bf6be7ca6a2408ba
- SSDEEP 98304:MJXk/HTZOZ8NW2ifraEYbJAakUfjm2Sk8dPDwQ4229Szk:MqPq8NSfr6JAQC9k81Dwf2vk
- TLSH T11B967C13FC5928E9C1AEA23589B39253BB717C481B2263D71B90F3386E76BD16D78350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\config\OSDATA 2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe - Drops file in Windows directory 18 IoCs
description ioc Process File opened for modification C:\Windows\Vss\jNINvlHcVR.bin 2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe File opened for modification C:\Windows\Vss\IBkNQpwbjaoJ.bin 2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe File opened for modification C:\Windows\Vss\yGciPLyEZ.bin 2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe File opened for modification C:\Windows\Vss\ApyhWzCWMD.bin 2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe File opened for modification C:\Windows\Vss\sDriFRDj.bin 2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe File opened for modification C:\Windows\Vss\vSjVjkfSZVPtb.bin 2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe File opened for modification C:\Windows\Vss\RydXSYYWoiv.bin 2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe File opened for modification C:\Windows\Vss\GIOPcqRtPSlWn.bin 2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe File opened for modification C:\Windows\Vss\FwSSKaTIgnF.bin 2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe File opened for modification C:\Windows\Vss\sOVwucjx.bin 2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe File opened for modification C:\Windows\Vss\BIYwHTgozGu.bin 2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe File opened for modification C:\Windows\Vss\NxjXlzCmHKaIP.bin 2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe File opened for modification C:\Windows\Vss\YbGBRqzYIMlbn.bin 2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe File opened for modification C:\Windows\Vss\HVMpDqr.bin 2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe File opened for modification C:\Windows\Vss\nTLlqxIWEIFg.bin 2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe File opened for modification C:\Windows\Vss\kBdXUDf.bin 2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe File opened for modification C:\Windows\Vss\oHYHGHHChMsRP.bin 2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe File opened for modification C:\Windows\Vss\RtXuKV.bin 2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_dc382b92defa7150b0cd4b3ca5752859_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:3676
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\System32\config\OSDATA
- Size 36B
- SHA256 c35b48295db9244df8682700eac8cd3e9246e81f70036a38a6838cbe9a2c1716
- MD5 7b67d0eeccd32a701de0bb8dc4fef9a2
- SHA1 0f3ce5a483a420ab0cd72ae1a8a3c1086cfa12f2
- SHA512 36cccfd2df6a61ce18b629538721ff78e551b734c10d632c192130069807ce5bdfd66eb34ac040c1f256917e9a426a2961cbba4fa1646a33817f17c4fd0cf09a
- MD5 SHA1 SHA512