Analysis
- max time kernel
1s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 04:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_508302822b0fa3152db9c8d39c98c6ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_508302822b0fa3152db9c8d39c98c6ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target 2026-07-08_508302822b0fa3152db9c8d39c98c6ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 7.9MB
- Sample260708-e9588aaz6z
- SHA256 26ceff0b64572013fb9c9aa98c728d83411f97db0618fb3f122bf83deda00c29
- MD5 508302822b0fa3152db9c8d39c98c6ad
- SHA1 4c47b274f42cf13bf220d02b72741287f8c66d74
- SHA512 232a012d1bf5eed927b8afa0ada8d1d4cc036a9ecbb8dab1a734883cc3cd1fb6b7d8d13b2a2cf38eb34cd1d183dae25a1a446c1775b3d1555b9c7a534b271d03
- SSDEEP 49152:ioanlkhlw0yJMfnmADSj0LmxTSviiMD0wx0QwVsNc34FwOMNGnQ6g/ns8V4Qfrpb:iGBfgvNkGwj/PAZO/QESEx
- TLSH T183863847FCA555E8C0AED2358A66A616BB713C494F3123E72F50B2283F76BD06DB9340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Kills process with taskkill 2 IoCs
pid Process 1196 taskkill.exe 4660 taskkill.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 6056 wmic.exe 6056 wmic.exe 6056 wmic.exe 6056 wmic.exe 2860 wmic.exe 2860 wmic.exe 2860 wmic.exe 2860 wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 6056 wmic.exe Token: SeSecurityPrivilege 6056 wmic.exe Token: SeTakeOwnershipPrivilege 6056 wmic.exe Token: SeLoadDriverPrivilege 6056 wmic.exe Token: SeSystemProfilePrivilege 6056 wmic.exe Token: SeSystemtimePrivilege 6056 wmic.exe Token: SeProfSingleProcessPrivilege 6056 wmic.exe Token: SeIncBasePriorityPrivilege 6056 wmic.exe Token: SeCreatePagefilePrivilege 6056 wmic.exe Token: SeBackupPrivilege 6056 wmic.exe Token: SeRestorePrivilege 6056 wmic.exe Token: SeShutdownPrivilege 6056 wmic.exe Token: SeDebugPrivilege 6056 wmic.exe Token: SeSystemEnvironmentPrivilege 6056 wmic.exe Token: SeRemoteShutdownPrivilege 6056 wmic.exe Token: SeUndockPrivilege 6056 wmic.exe Token: SeManageVolumePrivilege 6056 wmic.exe Token: 33 6056 wmic.exe Token: 34 6056 wmic.exe Token: 35 6056 wmic.exe Token: 36 6056 wmic.exe Token: SeIncreaseQuotaPrivilege 6056 wmic.exe Token: SeSecurityPrivilege 6056 wmic.exe Token: SeTakeOwnershipPrivilege 6056 wmic.exe Token: SeLoadDriverPrivilege 6056 wmic.exe Token: SeSystemProfilePrivilege 6056 wmic.exe Token: SeSystemtimePrivilege 6056 wmic.exe Token: SeProfSingleProcessPrivilege 6056 wmic.exe Token: SeIncBasePriorityPrivilege 6056 wmic.exe Token: SeCreatePagefilePrivilege 6056 wmic.exe Token: SeBackupPrivilege 6056 wmic.exe Token: SeRestorePrivilege 6056 wmic.exe Token: SeShutdownPrivilege 6056 wmic.exe Token: SeDebugPrivilege 6056 wmic.exe Token: SeSystemEnvironmentPrivilege 6056 wmic.exe Token: SeRemoteShutdownPrivilege 6056 wmic.exe Token: SeUndockPrivilege 6056 wmic.exe Token: SeManageVolumePrivilege 6056 wmic.exe Token: 33 6056 wmic.exe Token: 34 6056 wmic.exe Token: 35 6056 wmic.exe Token: 36 6056 wmic.exe Token: SeDebugPrivilege 1196 taskkill.exe Token: SeIncreaseQuotaPrivilege 2860 wmic.exe Token: SeSecurityPrivilege 2860 wmic.exe Token: SeTakeOwnershipPrivilege 2860 wmic.exe Token: SeLoadDriverPrivilege 2860 wmic.exe Token: SeSystemProfilePrivilege 2860 wmic.exe Token: SeSystemtimePrivilege 2860 wmic.exe Token: SeProfSingleProcessPrivilege 2860 wmic.exe Token: SeIncBasePriorityPrivilege 2860 wmic.exe Token: SeCreatePagefilePrivilege 2860 wmic.exe Token: SeBackupPrivilege 2860 wmic.exe Token: SeRestorePrivilege 2860 wmic.exe Token: SeShutdownPrivilege 2860 wmic.exe Token: SeDebugPrivilege 2860 wmic.exe Token: SeSystemEnvironmentPrivilege 2860 wmic.exe Token: SeRemoteShutdownPrivilege 2860 wmic.exe Token: SeUndockPrivilege 2860 wmic.exe Token: SeManageVolumePrivilege 2860 wmic.exe Token: 33 2860 wmic.exe Token: 34 2860 wmic.exe Token: 35 2860 wmic.exe Token: 36 2860 wmic.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3636 wrote to memory of 6056 3636 2026-07-08_508302822b0fa3152db9c8d39c98c6ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 88 PID 3636 wrote to memory of 1196 3636 2026-07-08_508302822b0fa3152db9c8d39c98c6ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 91 PID 3636 wrote to memory of 2860 3636 2026-07-08_508302822b0fa3152db9c8d39c98c6ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_508302822b0fa3152db9c8d39c98c6ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_508302822b0fa3152db9c8d39c98c6ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\System32\Wbem\wmic.exewmic process where ExecutablePath='C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-08_508302822b0fa3152db9c8d39c98c6ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe' get ProcessId2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6056
-
-
C:\Windows\system32\taskkill.exetaskkill /F /FI "PID ne 3636" /IM 2026-07-08_508302822b0fa3152db9c8d39c98c6ad_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1196
-
-
C:\Windows\System32\Wbem\wmic.exewmic process where ExecutablePath='C:\\ProgramData\\Microsoft\\Windows\\MainSystemWorker\\svchost.exe' get ProcessId2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-
C:\ProgramData\Microsoft\Windows\MainSystemWorker\svchost.exeC:\ProgramData\Microsoft\Windows\MainSystemWorker\svchost.exe2⤵PID:2528
-
C:\Windows\System32\Wbem\wmic.exewmic process where ExecutablePath='C:\\ProgramData\\Microsoft\\Windows\\MainSystemWorker\\svchost.exe' get ProcessId3⤵PID:1840
-
-
C:\Windows\system32\taskkill.exetaskkill /F /FI "PID ne 2528" /IM svchost.exe3⤵
- Kills process with taskkill
PID:4660
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\Windows\mainsystemworker\svchost.exe
- Size 7.9MB
- SHA256 933fcb5039bd81887ef3b7f4a62605f7fe97ea9f06074698f1b0e35531c9588a
- MD5 062b645653dbc4a9b28b073a2745b3d4
- SHA1 442cd5dc6d9a173e9a875c91265d4af48308e22d
- SHA512 4c975f2ea39fa0b6203eb5bf012faa0c0b603ce60b3afb55bd12613cf8ddd2350c7f35013e346447fd1db323a8486ae17364e1b93eb4a2ea1ce9c2840fce54d6
- SSDEEP 49152:ioanlkhlw0yJMfnmADSj0LmxTSviiMD0wx0QwVsNc34FwOMNGnQ6g/ns8V4QfrpK:iGBfgvNkGwj/PAZO/QESEU
- TLSH T1CF863847FCA555E8C0AED2358A66A616BB713C494F3123E72F50B2283F76BD06DB9340
- MD5 SHA1 SHA512 SSDEEP TLSH