c70b9f65dfcf4bd674d4debd52a170183558456d8b843bb6b9ad9cd95b7d5966

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_af40a6eb81b066a91f47fd12b0dc7ed4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 12.5MB
Sample260712-ts9mmsc12m
SHA256 c70b9f65dfcf4bd674d4debd52a170183558456d8b843bb6b9ad9cd95b7d5966
MD5 af40a6eb81b066a91f47fd12b0dc7ed4
SHA1 55b2ef7084c7b3e4722615156f65ee9f69fd71bc
SHA512 a1f7d20ed51f6ef18faa23aa249b76ed2d713902e4f01e68a4b4eeaeaaa7941ec4a83a9890bdb28348c1b41f072037c2619f5186b75d527dc279077583ae54cf
SSDEEP 49152:F31Je54TJwdFUqLa0rDUVHGVRZfwLlFsFS7yw9xeJIZnHxQy8m7KmR7f4KAe/ygJ:F33ugas9xWItRQtgqYfXYVDX9HJA9CE
TLSH
T1C6D64A57E9950AE9C5ADD630C9B692237B717C480B3223C72B50B6786F77BD0AE79300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-12_af40a6eb81b066a91f47fd12b0dc7ed4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-12_af40a6eb81b066a91f47fd12b0dc7ed4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-12_af40a6eb81b066a91f47fd12b0dc7ed4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_af40a6eb81b066a91f47fd12b0dc7ed4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Checks processor information in registry
PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads