90c57cbd6e1bab4cf264e1ce5aefa99410115accae53fd7af300b241baf08f86

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 23:40

Target
2026-07-16_e42ceaa8e6b4f5cde7558e052e31c182_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 8.8MB
Sample260716-3n3g7sf14q
SHA256 90c57cbd6e1bab4cf264e1ce5aefa99410115accae53fd7af300b241baf08f86
MD5 e42ceaa8e6b4f5cde7558e052e31c182
SHA1 b93321db43d1b86fb1452c838987a9ca9ba7b3b7
SHA512 293cd89f1a4289c11b4d351f1f237191ba19e40624ea56e68ef24ee3447dfaccbc290fcbe0dd946b594a2ca2dc2306e033c8ca6f8fe36c9ade19e5f5a96bc4cd
SSDEEP 98304:kYG610oBjPvie0UVVDEl/oPwxBYyd4r3Cd006iHS:km1R4UwsgBYydBSliHS
TLSH
T1E1968C03EC6518E9C1ADA23189B69653BB31BC480B2263D72B50F6387F77BD4AD79314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3740	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3740	AUDIODG.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 3184	1508	2026-07-16_e42ceaa8e6b4f5cde7558e052e31c182_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-16_e42ceaa8e6b4f5cde7558e052e31c182_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_e42ceaa8e6b4f5cde7558e052e31c182_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\system32\cmd.exe
  cmd /c title "Discord Tokens Raider | discord.gg/tden"
  2⤵
  PID:3184

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004A8 0x00000000000004AC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3740