Analysis
- max time kernel
1s - max time network
13s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/07/2026, 14:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-07_34f3d76d7a1e5ccb1858bba5fdf1cc23_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-07_34f3d76d7a1e5ccb1858bba5fdf1cc23_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target 2026-07-07_34f3d76d7a1e5ccb1858bba5fdf1cc23_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 7.9MB
- Sample260707-rtcm7af19m
- SHA256 063f0717469c0c1870b4bf9de5152675515f962d63014e7c637523083b48cb4f
- MD5 34f3d76d7a1e5ccb1858bba5fdf1cc23
- SHA1 34c9b433c4c3a14e078b4f8aee7622ffc612de29
- SHA512 830bc4cc845a90b45763e18b3ed17da00f27965438e04574ca521f202408372244be6b6b11665d75069ee24858607e8d04fb6368ddadb4c3d4a8d425b2434053
- SSDEEP 49152:hlccDWA2I+JCOs3ok6c9/87lS51zNHsr2cG8ml8LJinT7bcd5rxJ/RuQBoeYSgQ/:hbIJmginAD//ghQ16pE
- TLSH T19B862807FDA614E8C0ADD2358A629567BA723C494F3127E32F50B6242FB6BD06DF9350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Kills process with taskkill 2 IoCs
pid Process 4296 taskkill.exe 5412 taskkill.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1864 wmic.exe Token: SeSecurityPrivilege 1864 wmic.exe Token: SeTakeOwnershipPrivilege 1864 wmic.exe Token: SeLoadDriverPrivilege 1864 wmic.exe Token: SeSystemProfilePrivilege 1864 wmic.exe Token: SeSystemtimePrivilege 1864 wmic.exe Token: SeProfSingleProcessPrivilege 1864 wmic.exe Token: SeIncBasePriorityPrivilege 1864 wmic.exe Token: SeCreatePagefilePrivilege 1864 wmic.exe Token: SeBackupPrivilege 1864 wmic.exe Token: SeRestorePrivilege 1864 wmic.exe Token: SeShutdownPrivilege 1864 wmic.exe Token: SeDebugPrivilege 1864 wmic.exe Token: SeSystemEnvironmentPrivilege 1864 wmic.exe Token: SeRemoteShutdownPrivilege 1864 wmic.exe Token: SeUndockPrivilege 1864 wmic.exe Token: SeManageVolumePrivilege 1864 wmic.exe Token: 33 1864 wmic.exe Token: 34 1864 wmic.exe Token: 35 1864 wmic.exe Token: 36 1864 wmic.exe Token: SeIncreaseQuotaPrivilege 1864 wmic.exe Token: SeSecurityPrivilege 1864 wmic.exe Token: SeTakeOwnershipPrivilege 1864 wmic.exe Token: SeLoadDriverPrivilege 1864 wmic.exe Token: SeSystemProfilePrivilege 1864 wmic.exe Token: SeSystemtimePrivilege 1864 wmic.exe Token: SeProfSingleProcessPrivilege 1864 wmic.exe Token: SeIncBasePriorityPrivilege 1864 wmic.exe Token: SeCreatePagefilePrivilege 1864 wmic.exe Token: SeBackupPrivilege 1864 wmic.exe Token: SeRestorePrivilege 1864 wmic.exe Token: SeShutdownPrivilege 1864 wmic.exe Token: SeDebugPrivilege 1864 wmic.exe Token: SeSystemEnvironmentPrivilege 1864 wmic.exe Token: SeRemoteShutdownPrivilege 1864 wmic.exe Token: SeUndockPrivilege 1864 wmic.exe Token: SeManageVolumePrivilege 1864 wmic.exe Token: 33 1864 wmic.exe Token: 34 1864 wmic.exe Token: 35 1864 wmic.exe Token: 36 1864 wmic.exe Token: SeDebugPrivilege 4296 taskkill.exe Token: SeIncreaseQuotaPrivilege 5896 wmic.exe Token: SeSecurityPrivilege 5896 wmic.exe Token: SeTakeOwnershipPrivilege 5896 wmic.exe Token: SeLoadDriverPrivilege 5896 wmic.exe Token: SeSystemProfilePrivilege 5896 wmic.exe Token: SeSystemtimePrivilege 5896 wmic.exe Token: SeProfSingleProcessPrivilege 5896 wmic.exe Token: SeIncBasePriorityPrivilege 5896 wmic.exe Token: SeCreatePagefilePrivilege 5896 wmic.exe Token: SeBackupPrivilege 5896 wmic.exe Token: SeRestorePrivilege 5896 wmic.exe Token: SeShutdownPrivilege 5896 wmic.exe Token: SeDebugPrivilege 5896 wmic.exe Token: SeSystemEnvironmentPrivilege 5896 wmic.exe Token: SeRemoteShutdownPrivilege 5896 wmic.exe Token: SeUndockPrivilege 5896 wmic.exe Token: SeManageVolumePrivilege 5896 wmic.exe Token: 33 5896 wmic.exe Token: 34 5896 wmic.exe Token: 35 5896 wmic.exe Token: 36 5896 wmic.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5968 wrote to memory of 1864 5968 2026-07-07_34f3d76d7a1e5ccb1858bba5fdf1cc23_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 86 PID 5968 wrote to memory of 4296 5968 2026-07-07_34f3d76d7a1e5ccb1858bba5fdf1cc23_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 89 PID 5968 wrote to memory of 5896 5968 2026-07-07_34f3d76d7a1e5ccb1858bba5fdf1cc23_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_34f3d76d7a1e5ccb1858bba5fdf1cc23_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-07_34f3d76d7a1e5ccb1858bba5fdf1cc23_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Windows\System32\Wbem\wmic.exewmic process where ExecutablePath='C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-07_34f3d76d7a1e5ccb1858bba5fdf1cc23_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe' get ProcessId2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
C:\Windows\system32\taskkill.exetaskkill /F /FI "PID ne 5968" /IM 2026-07-07_34f3d76d7a1e5ccb1858bba5fdf1cc23_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4296
-
-
C:\Windows\System32\Wbem\wmic.exewmic process where ExecutablePath='C:\\ProgramData\\Microsoft\\Windows\\MainSystemWorker\\svchost.exe' get ProcessId2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5896
-
-
C:\ProgramData\Microsoft\Windows\MainSystemWorker\svchost.exeC:\ProgramData\Microsoft\Windows\MainSystemWorker\svchost.exe2⤵PID:3684
-
C:\Windows\System32\Wbem\wmic.exewmic process where ExecutablePath='C:\\ProgramData\\Microsoft\\Windows\\MainSystemWorker\\svchost.exe' get ProcessId3⤵PID:3172
-
-
C:\Windows\system32\taskkill.exetaskkill /F /FI "PID ne 3684" /IM svchost.exe3⤵
- Kills process with taskkill
PID:5412
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\Windows\MainSystemWorker\svchost.exe
- Size 3.9MB
- SHA256 e7b531de657b906e6e35032267598d62bbed91109265740886bf8e8e40752dbe
- MD5 2acdcda33add4f4c13141e233eaf97a9
- SHA1 0b07a030dede7c73b77118ea61ff88c15a93f046
- SHA512 ea7ede4afb46d7983127bad5e0c6a9628086b6ff6d7e893ebe71c1d085b9c46b6d80e585375a995a2be84ae7f811b547cefc455106ef8878964dbc9b6d73b944
- SSDEEP 49152:hlccDWA2I+JCOs3ok6c9/87lS51zNHsr2cG8ml8LJinT7bcd5rxJ/RuQBoeYSgQU:hbIJmginAD//ghQU
- TLSH T16516C657EDB940E880EED569C776EA17BDA23449833433E76FA19A101F1AFE064BD700
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\mainsystemworker\svchost.exe
- Size 4.8MB
- SHA256 a83133c861b574263327c42a54839cf8d86d39c8b33c16b95b832102b1f98c6e
- MD5 d585b2c5c9678c8a50595e3884ae4a34
- SHA1 864778b63703e3c25c03927036f93fde9a0abd1f
- SHA512 85be6d3ba11fedbddcfd9f852827983e8be6ad66bdf13bdfa4240d0ad5d70cec342efc938e6d3029697bb1f7336a70703e83595a810716c4425522b006ae6caa
- SSDEEP 49152:hlccDWA2I+JCOs3ok6c9/87lS51zNHsr2cG8ml8LJinT7bcd5rxJ/RuQBoeYSgQu:hbIJmginAD//ghQ1
- TLSH T1D536E757BDA940E8C0FEC136C666A917BEA23849473437E36F61A6101F26FE06DBD740
- MD5 SHA1 SHA512 SSDEEP TLSH