Overview

overview

7

Static

static

3

2026-07-01...at.exe

windows10-2004-x64

7

2026-07-01...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 09:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_4ec7bd5533a1f51a415ec9612f258140_coinminer_dosia_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat.exe
  • Size 34.3MB
  • Sample260701-lwhdkads9x
  • SHA256 16cdf1b76fbf8693a40d4d13b2922904f6cde9602e3756a861af331d3634939c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
persistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_4ec7bd5533a1f51a415ec9612f258140_coinminer_dosia_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_4ec7bd5533a1f51a415ec9612f258140_coinminer_dosia_ghostlocker_glassworm_luca-stealer_poet-rat_quasar-rat.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Program Files\Google\Chrome\Application\v20mk.exe
      "C:\Program Files\Google\Chrome\Application\v20mk.exe"
      2⤵
      • Executes dropped EXE
      PID:6116
    • C:\Program Files (x86)\Microsoft\Edge\Application\v20mk.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\v20mk.exe"
      2⤵
      • Executes dropped EXE
      PID:4836
    • C:\Windows\system32\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\configdat.dat
      2⤵
        PID:2100
      • C:\Users\Admin\AppData\Local\Drivers\update.exe
        C:\Users\Admin\AppData\Local\Drivers\update.exe
        2⤵
        • Executes dropped EXE
        PID:4460
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
        PID:2796
      • C:\Users\Admin\AppData\Local\Drivers\update.exe
        C:\Users\Admin\AppData\Local\Drivers\update.exe
        1⤵
        • Executes dropped EXE
        PID:5776

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            v20mk.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\v20mk.exe
            • Size 3.4MB
            • SHA256 d6e8e3d903de77a40287200141305da7eb1c378d892c735f5d8c33333cc8d9af
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            v20mk.exe
            • Path C:\Program Files\Google\Chrome\Application\v20mk.exe
            • Size 3.4MB
            • SHA256 2edf1a33e51216a3eb895a20579abcaad17b68088d83aaca18c60bca2e10d69e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            update.exe
            • Path C:\Users\Admin\AppData\Local\Drivers\update.exe
            • Size 2.9MB
            • SHA256 aceed713d2428ed14b0889286364402316cfb7c1da9acb239ae35607710b7b46
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            messages.json
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\klhljjaejdkfmdkmcfknhfedgjmnmijp\28.1147.22_0\_locales\en\messages.json
            • Size 8KB
            • SHA256 65378f2f8f90912ec8f23333fdc346cc9d03ca17cf7154cb1a2d21b93f9bb661
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            messages.json
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\klhljjaejdkfmdkmcfknhfedgjmnmijp\28.1147.22_0\_locales\pt_BR\messages.json
            • Size 9KB
            • SHA256 ce602608f85669b0155a93e60e1b1efc33e06120f74b13f960ebf97661e102b2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bg.js
            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\klhljjaejdkfmdkmcfknhfedgjmnmijp\28.1147.22_0\adblock\bg.js
            • Size 150KB
            • SHA256 d0653507ce28819165dc5f6df97643e9ec2d8ae6270f4951014573eb6b7a076c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/2896-394-0x00007FF6E57E0000-0x00007FF6E7A92000-memory.dmp
            Download