85db36875a4bf3d14bf323a48555eb68f4b15aeda4a1af2162cf1fe403695e1d

Analysis

max time kernel
150s
max time network
105s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 04:20

Target
2026-06-30_75376412b92f519f9596f0ae95daf500_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 11.2MB
Sample260701-ex6dfses4j
SHA256 85db36875a4bf3d14bf323a48555eb68f4b15aeda4a1af2162cf1fe403695e1d
MD5 75376412b92f519f9596f0ae95daf500
SHA1 459aca709b6743e766ce45103a390afdfc0deb5f
SHA512 cdd6b08d58f3bc4beb67c2260dfe0061387481d98ba8cac4234cc1a453d17bc88cb119db4d32ed0461f40c6f504f39eea6918389857c1832afeee2bc331d8367
SSDEEP 98304:FHumgEQCymkGoelzOr/+GjqxiDpl1s0MWqRsE3:FtBvOD4
TLSH
T1A1C63A87E8A545D9C0AEC175CA369563BB713C894B2063D35B60FB252F33BD0AEB9701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

flow	ioc
1	discord.com
2	discord.com

C:\Users\Admin\AppData\Local\Temp\2026-06-30_75376412b92f519f9596f0ae95daf500_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_75376412b92f519f9596f0ae95daf500_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
PID:1808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2604

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact