550fa3ac9d859004ac9eb5a3519d2aadc9df2d35a6a63444378b80cd19ca4585

Analysis

max time kernel
150s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 00:47

Target
2026-07-06_d1443be4985f30bf392cf954edcce3de_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 11.1MB
Sample260707-a5dk7aex4z
SHA256 550fa3ac9d859004ac9eb5a3519d2aadc9df2d35a6a63444378b80cd19ca4585
MD5 d1443be4985f30bf392cf954edcce3de
SHA1 91055822d8abe47a357bf190dcb08dc03bc1d379
SHA512 24d00c4076dd39cc5ef7df7e657a342439971d5c4539ea988e404e965ee3de75d10d7cd31e75a7802ce135a2a9be5872ead8c435ace40eb09db696abe5d35241
SSDEEP 49152:SRYtTsKGIqB0XNHrB5CyWiJ5CwdrdRLwjgXO7os0Yh4ElAbUF9G/nYV5TAORvlj6:SGyE+QZLzs0cGb89GfftwqVc2773hiE
TLSH
T15AC63947E9A555E5C0AEC1758A369552BB703C895B3023D36BA0F7342F37BE0AEB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

flow	ioc
1	discord.com
2	discord.com

C:\Users\Admin\AppData\Local\Temp\2026-07-06_d1443be4985f30bf392cf954edcce3de_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_d1443be4985f30bf392cf954edcce3de_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
PID:5624

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact