Analysis
- max time kernel
150s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
- Size 24.8MB
- Sample260714-ee99paf13s
- SHA256 e6090f37afaf562b3e894c7d68df3e235eb0d48bfd7065e5f0311a0fe8e822b5
- MD5 5ec33236dc18466bfa3f66d09e105364
- SHA1 eecbe9cf7daa606832928e90d464d4b15cfeec21
- SHA512 15198b7ce80a0ec7de04628c75b515235767fb2efdb14c7d4cc2a4399b51f5661aeec765a675d4048da476dab59c42d416bf4db05f7452759cbbc1f0685807ea
- SSDEEP 196608:R/9XpME7ZDSwCXj7bye9Ry+M2Cfawz5y/f:RVXp7zCfbyeD02CTC
- TLSH T15D472A67F8D21AC8C4EAC570D672413BBB613C690B7863EB1690B3601F36BD09BB2755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 4572 wmic.exe 4572 wmic.exe 4572 wmic.exe 4572 wmic.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4572 wmic.exe Token: SeSecurityPrivilege 4572 wmic.exe Token: SeTakeOwnershipPrivilege 4572 wmic.exe Token: SeLoadDriverPrivilege 4572 wmic.exe Token: SeSystemProfilePrivilege 4572 wmic.exe Token: SeSystemtimePrivilege 4572 wmic.exe Token: SeProfSingleProcessPrivilege 4572 wmic.exe Token: SeIncBasePriorityPrivilege 4572 wmic.exe Token: SeCreatePagefilePrivilege 4572 wmic.exe Token: SeBackupPrivilege 4572 wmic.exe Token: SeRestorePrivilege 4572 wmic.exe Token: SeShutdownPrivilege 4572 wmic.exe Token: SeDebugPrivilege 4572 wmic.exe Token: SeSystemEnvironmentPrivilege 4572 wmic.exe Token: SeRemoteShutdownPrivilege 4572 wmic.exe Token: SeUndockPrivilege 4572 wmic.exe Token: SeManageVolumePrivilege 4572 wmic.exe Token: 33 4572 wmic.exe Token: 34 4572 wmic.exe Token: 35 4572 wmic.exe Token: 36 4572 wmic.exe Token: SeIncreaseQuotaPrivilege 4572 wmic.exe Token: SeSecurityPrivilege 4572 wmic.exe Token: SeTakeOwnershipPrivilege 4572 wmic.exe Token: SeLoadDriverPrivilege 4572 wmic.exe Token: SeSystemProfilePrivilege 4572 wmic.exe Token: SeSystemtimePrivilege 4572 wmic.exe Token: SeProfSingleProcessPrivilege 4572 wmic.exe Token: SeIncBasePriorityPrivilege 4572 wmic.exe Token: SeCreatePagefilePrivilege 4572 wmic.exe Token: SeBackupPrivilege 4572 wmic.exe Token: SeRestorePrivilege 4572 wmic.exe Token: SeShutdownPrivilege 4572 wmic.exe Token: SeDebugPrivilege 4572 wmic.exe Token: SeSystemEnvironmentPrivilege 4572 wmic.exe Token: SeRemoteShutdownPrivilege 4572 wmic.exe Token: SeUndockPrivilege 4572 wmic.exe Token: SeManageVolumePrivilege 4572 wmic.exe Token: 33 4572 wmic.exe Token: 34 4572 wmic.exe Token: 35 4572 wmic.exe Token: 36 4572 wmic.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1360 wrote to memory of 4572 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 88 PID 1360 wrote to memory of 4912 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 90 PID 1360 wrote to memory of 2644 1360 2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_5ec33236dc18466bfa3f66d09e105364_coinminer_dosia_poet-rat_quasar-rat_snatch.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\System32\Wbem\wmic.exewmic cpu get ProcessorId2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4572
-
-
C:\Windows\system32\getmac.exegetmac /fo csv /nh2⤵PID:4912
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid2⤵PID:2644
-