3450f0eb095a649feac5efe9ff4e8f767562916d6d8815a4a29929f87089dbaf

General

Target
2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.3MB
Sample260718-e98pcagw3m
SHA256 3450f0eb095a649feac5efe9ff4e8f767562916d6d8815a4a29929f87089dbaf
MD5 1ee61d71d43c17871c45f10bc89169c8
SHA1 4d5d3b2b527b31f205ac90424ae07a3467a02c3a
SHA512 1051999da29a451130d569a3d80404c1e6c1e2595e1152233f868357ff9fd83265ff7593b3cddf0cb73c2e452b93e43c265f7a0af13c186dfafcd98876795a2e
SSDEEP 49152:yAb0GFyIZNN01Xubugx/yJnibDBAKy3FpwKBQcsr7wefMER6uCkkrgyQXnyDKVKD:yAPTjNrbUwUqeuCkkOyL67BE
TLSH
T17B762843FC9619E9C1ADE1368A739112BB217C491B3123D31AA4F7283F76BD06EB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HostService.url	2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HostService.url	2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4660	cmd.exe
4868	cmd.exe
4344	cmd.exe
4568	cmd.exe
3004	cmd.exe
2416	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5016	schtasks.exe
776	schtasks.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 4660	1464	2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	87
PID 1464 wrote to memory of 4868	1464	2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 4868 wrote to memory of 4496	4868	cmd.exe	91
PID 1464 wrote to memory of 4344	1464	2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92
PID 4344 wrote to memory of 5016	4344	cmd.exe	94
PID 1940 wrote to memory of 4568	1940	2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	97
PID 1940 wrote to memory of 3004	1940	2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	100
PID 3004 wrote to memory of 2868	3004	cmd.exe	102
PID 1940 wrote to memory of 2416	1940	2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	103
PID 2416 wrote to memory of 776	2416	cmd.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\system32\cmd.exe
  cmd /c title "Windows Host Process"
  2⤵
  - Executes a command shell one-liner
  PID:4660
- C:\Windows\system32\cmd.exe
  cmd /c "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"HostService\" /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\system32\reg.exe
    reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"HostService\" /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" /f
    3⤵
    PID:4496
- C:\Windows\system32\cmd.exe
  cmd /c "schtasks /create /tn \"SystemUpdateTask\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" /sc ONLOGON /ru \"Admin\" /f /it"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"SystemUpdateTask\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" /sc ONLOGON /ru \"Admin\" /f /it
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5016

C:\Users\Admin\AppData\Local\Temp\2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\system32\cmd.exe
  cmd /c title "Windows Host Process"
  2⤵
  - Executes a command shell one-liner
  PID:4568
- C:\Windows\system32\cmd.exe
  cmd /c "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"HostService\" /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\system32\reg.exe
    reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"HostService\" /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" /f
    3⤵
    PID:2868
- C:\Windows\system32\cmd.exe
  cmd /c "schtasks /create /tn \"SystemUpdateTask\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" /sc ONLOGON /ru \"Admin\" /f /it"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"SystemUpdateTask\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-17_1ee61d71d43c17871c45f10bc89169c8_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" /sc ONLOGON /ru \"Admin\" /f /it
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysupd.log

Path C:\Users\Admin\AppData\Local\Temp\sysupd.log
Size 502B
SHA256 5f65ac5e2cdcaa81888e9ec29807a9fcc3969451aaaee73bd1e365e47dcd4e29
MD5 71429f3b7f10c5be7766fad9c848dc54
SHA1 03441ea3af0338fd8af289f1dbe6dd394e6b0170
SHA512 bafd9a0d3a7bddb0995e9e212efd648b6082e87c03561488a328a050dfd30581314da3a420ac2ff297f6041e784456d2c2499c5ce4a11427873d248b287891e5
TLSH
T174F0821279E625BF6B011E11C0A29F10D795B347F304C80CF7BAD65927D7E520DAE430
MD5 SHA1 SHA512 TLSH

Submit Download

sysupd.log

Path C:\Users\Admin\AppData\Local\Temp\sysupd.log
Size 548B
SHA256 72ae203b53588402f6d816716afe5ecd8cde04c1395360f41fe42c99557e86c1
MD5 f701be90b14e151a5e87a25be2b978a9
SHA1 15e8984323d1e4db91737f0d4c6cc9679511cd6d
SHA512 12b43f37d0c020bd01c603991e5c33750d4ec55164f3923bf68d9104d36b0ea38a8de93291a54ebb23d187e2a5813f80a1a9150c97f64eb4d73a22f232de25f0
TLSH
T119F0301279A625BF6B021E11C0925F10D795B347F204C80CF7BEE65927D7E620DAE430
MD5 SHA1 SHA512 TLSH

Submit Download

HostService.url

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HostService.url
Size 328B
SHA256 dd5b91298bce80a57cb9d31fdb7cddb4cd816dd77f6c4e94705974c5f9489ed7
MD5 9f10debda79fbd6769e68017478f9c25
SHA1 e9fec7db495ca6592ca11fa18fc3258e2ba65622
SHA512 9a1aff83fda425762a04fcafdb0e971a85f2793263ee5de8c572b4e104adc91ce5a42826b891b36e10c7d440d15aa0493b165e8d6d93614b848419f3ffd0421b
TLSH
T1F6E026308906EA31A883510683F28F0EC49A54CEB1A44706E3B0A8CC2EB290F7A44214
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\OverloadOps\config.json
Size 353B
SHA256 ee8f745b0d65ae7c5474bb48b6efe5fc751e5b4b348d5957531bdd5a56fa2973
MD5 6f29a282b66db6988ca98db142ad7f9e
SHA1 caa250d1910289f2a49e60a143c92e69b05af0cd
SHA512 622bde0e1081ae09f7c559a9b103e5475e84aaa52cd0a33c133bcd07741fc2344b510a34db709fae6bd61ac07ea7c53f7946c25014f4fb214bd4bb16a5cb75c4
TLSH
T16EE0268BC9450C6740C4A3712273550E2883F14B5C11380AF340E73E0F4C1ABA7B498E
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads