f115f83cf90cec73df127d5d5ff46db90dba595d1f9c36db79c561ec63c7fb6e

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_0d0be25704beb9d8b59e34470ff10bf8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 6.9MB
Sample260706-2nf4jac12z
SHA256 f115f83cf90cec73df127d5d5ff46db90dba595d1f9c36db79c561ec63c7fb6e
MD5 0d0be25704beb9d8b59e34470ff10bf8
SHA1 f8ed07318ce083f7845adf5a0235f6a85d129cdf
SHA512 7053fec2b464fb1a860d8b4bb511bc3c6b64721f39e35c35c4fdadd372fd266745fc8aea25d7dab13e74e099ab781b40c0a386349afafb5289a45a25da575a9e
SSDEEP 49152:gVMH9T1kFTs+AMPj9/cSWi2/W8HfC7xo6h5b49VqtNjFY05th6QADLyjKQK1KFl3:gV88wGsSgkPFYOhOyzquOvBhdhuTcE
TLSH
T1C8764A07EDA864E9C0ADD1318A639553BB617C495B3123D32B90F7283F76BE0ADB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3636	2026-07-06_0d0be25704beb9d8b59e34470ff10bf8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3636	2026-07-06_0d0be25704beb9d8b59e34470ff10bf8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
3636	2026-07-06_0d0be25704beb9d8b59e34470ff10bf8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 2720	3636	2026-07-06_0d0be25704beb9d8b59e34470ff10bf8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	87
PID 3636 wrote to memory of 5840	3636	2026-07-06_0d0be25704beb9d8b59e34470ff10bf8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 3636 wrote to memory of 2824	3636	2026-07-06_0d0be25704beb9d8b59e34470ff10bf8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 3636 wrote to memory of 4032	3636	2026-07-06_0d0be25704beb9d8b59e34470ff10bf8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-06_0d0be25704beb9d8b59e34470ff10bf8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_0d0be25704beb9d8b59e34470ff10bf8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools"
  2⤵
  - Looks for VMWare Tools registry key
  PID:2720
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  PID:5840
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"
  2⤵
  PID:2824
- C:\Windows\system32\getmac.exe
  getmac /fo csv /nh
  2⤵
  PID:4032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads