063f0717469c0c1870b4bf9de5152675515f962d63014e7c637523083b48cb4f

Analysis

max time kernel
1s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-07-07_34f3d76d7a1e5ccb1858bba5fdf1cc23_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.9MB
Sample260707-rtcm7af19m
SHA256 063f0717469c0c1870b4bf9de5152675515f962d63014e7c637523083b48cb4f
MD5 34f3d76d7a1e5ccb1858bba5fdf1cc23
SHA1 34c9b433c4c3a14e078b4f8aee7622ffc612de29
SHA512 830bc4cc845a90b45763e18b3ed17da00f27965438e04574ca521f202408372244be6b6b11665d75069ee24858607e8d04fb6368ddadb4c3d4a8d425b2434053
SSDEEP 49152:hlccDWA2I+JCOs3ok6c9/87lS51zNHsr2cG8ml8LJinT7bcd5rxJ/RuQBoeYSgQ/:hbIJmginAD//ghQ16pE
TLSH
T19B862807FDA614E8C0ADD2358A629567BA723C494F3127E32F50B6242FB6BD06DF9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

defense_evasion

Malware Config

Signatures

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
2948	taskkill.exe
2488	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2428	wmic.exe
2428	wmic.exe
2428	wmic.exe
2428	wmic.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2428	wmic.exe
Token: SeSecurityPrivilege	2428	wmic.exe
Token: SeTakeOwnershipPrivilege	2428	wmic.exe
Token: SeLoadDriverPrivilege	2428	wmic.exe
Token: SeSystemProfilePrivilege	2428	wmic.exe
Token: SeSystemtimePrivilege	2428	wmic.exe
Token: SeProfSingleProcessPrivilege	2428	wmic.exe
Token: SeIncBasePriorityPrivilege	2428	wmic.exe
Token: SeCreatePagefilePrivilege	2428	wmic.exe
Token: SeBackupPrivilege	2428	wmic.exe
Token: SeRestorePrivilege	2428	wmic.exe
Token: SeShutdownPrivilege	2428	wmic.exe
Token: SeDebugPrivilege	2428	wmic.exe
Token: SeSystemEnvironmentPrivilege	2428	wmic.exe
Token: SeRemoteShutdownPrivilege	2428	wmic.exe
Token: SeUndockPrivilege	2428	wmic.exe
Token: SeManageVolumePrivilege	2428	wmic.exe
Token: 33	2428	wmic.exe
Token: 34	2428	wmic.exe
Token: 35	2428	wmic.exe
Token: 36	2428	wmic.exe
Token: SeIncreaseQuotaPrivilege	2428	wmic.exe
Token: SeSecurityPrivilege	2428	wmic.exe
Token: SeTakeOwnershipPrivilege	2428	wmic.exe
Token: SeLoadDriverPrivilege	2428	wmic.exe
Token: SeSystemProfilePrivilege	2428	wmic.exe
Token: SeSystemtimePrivilege	2428	wmic.exe
Token: SeProfSingleProcessPrivilege	2428	wmic.exe
Token: SeIncBasePriorityPrivilege	2428	wmic.exe
Token: SeCreatePagefilePrivilege	2428	wmic.exe
Token: SeBackupPrivilege	2428	wmic.exe
Token: SeRestorePrivilege	2428	wmic.exe
Token: SeShutdownPrivilege	2428	wmic.exe
Token: SeDebugPrivilege	2428	wmic.exe
Token: SeSystemEnvironmentPrivilege	2428	wmic.exe
Token: SeRemoteShutdownPrivilege	2428	wmic.exe
Token: SeUndockPrivilege	2428	wmic.exe
Token: SeManageVolumePrivilege	2428	wmic.exe
Token: 33	2428	wmic.exe
Token: 34	2428	wmic.exe
Token: 35	2428	wmic.exe
Token: 36	2428	wmic.exe
Token: SeDebugPrivilege	2948	taskkill.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 2428	5004	2026-07-07_34f3d76d7a1e5ccb1858bba5fdf1cc23_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	88
PID 5004 wrote to memory of 2948	5004	2026-07-07_34f3d76d7a1e5ccb1858bba5fdf1cc23_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-07_34f3d76d7a1e5ccb1858bba5fdf1cc23_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_34f3d76d7a1e5ccb1858bba5fdf1cc23_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\System32\Wbem\wmic.exe
  wmic process where ExecutablePath='C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-07_34f3d76d7a1e5ccb1858bba5fdf1cc23_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe' get ProcessId
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2428
- C:\Windows\system32\taskkill.exe
  taskkill /F /FI "PID ne 5004" /IM 2026-07-07_34f3d76d7a1e5ccb1858bba5fdf1cc23_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\System32\Wbem\wmic.exe
  wmic process where ExecutablePath='C:\\ProgramData\\Microsoft\\Windows\\MainSystemWorker\\svchost.exe' get ProcessId
  2⤵
  PID:4148
- C:\ProgramData\Microsoft\Windows\MainSystemWorker\svchost.exe
  C:\ProgramData\Microsoft\Windows\MainSystemWorker\svchost.exe
  2⤵
  PID:2480
- - C:\Windows\System32\Wbem\wmic.exe
    wmic process where ExecutablePath='C:\\ProgramData\\Microsoft\\Windows\\MainSystemWorker\\svchost.exe' get ProcessId
    3⤵
    PID:3108
- - C:\Windows\system32\taskkill.exe
    taskkill /F /FI "PID ne 2480" /IM svchost.exe
    3⤵
    - Kills process with taskkill
    PID:2488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\ProgramData\Microsoft\Windows\mainsystemworker\svchost.exe
Size 7.9MB
SHA256 6b1a78e910ad1e88665b018acc7a4ecc0304fbed6620e738a7838dbbf4b2f41c
MD5 f0206f015b3da4bf2c7fea83b3356627
SHA1 69ae1703895d4a9999c55fdcf0b28860e10990b8
SHA512 0e97c5d5f0f4c4599cce3d053c6476dc628b86ad7fc1199aca9094eacd16d912411c451fd1edbdbea4de6700e4fe8242b334115702f85544dc09555a6dd378b1
SSDEEP 49152:hlccDWA2I+JCOs3ok6c9/87lS51zNHsr2cG8ml8LJinT7bcd5rxJ/RuQBoeYSgQO:hbIJmginAD//ghQ16pEG
TLSH
T17C862807FDA614E8C0ADD2358A629567BA723C494F3127E32F50B6242FB6BD06DF9350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download