546f4fe5c8a69cc576913c688aead9984e6e9c9b7a7d656e51fc32c590b157e7

General

Target
2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.3MB
Sample260718-kd64jag181
SHA256 546f4fe5c8a69cc576913c688aead9984e6e9c9b7a7d656e51fc32c590b157e7
MD5 2bfb3e1d27aa1b64af00575544c22917
SHA1 335839361a767ec3ca04e2d95401d0bd6f6f712a
SHA512 ae994ed91e53529f198878da2dfe66c4736ecf7b49cdbf4750a003e5ae71860a4320f1bb8940b9f3ec649bb71925db13883cdf55a5db663cb85276ad7209d64b
SSDEEP 98304:OgYR2rRCbZ92ROMLTy0ZppWawClHDqxbwKajNeWKs7ZEE:O3WY2ROMLT3d9
TLSH
T11E763803F89619E9C1AED1368AB391527B627C591B2127D31B90F3383F76BD06EB9344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HostService.url	2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HostService.url	2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4820	cmd.exe
5160	cmd.exe
4880	cmd.exe
4736	cmd.exe
4112	cmd.exe
4328	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1456	schtasks.exe
1356	schtasks.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5452 wrote to memory of 4820	5452	2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	88
PID 5452 wrote to memory of 5160	5452	2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	90
PID 5160 wrote to memory of 1720	5160	cmd.exe	92
PID 5452 wrote to memory of 4880	5452	2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 4880 wrote to memory of 1456	4880	cmd.exe	95
PID 4752 wrote to memory of 4736	4752	2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	98
PID 4752 wrote to memory of 4112	4752	2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	100
PID 4112 wrote to memory of 2104	4112	cmd.exe	102
PID 4752 wrote to memory of 4328	4752	2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	103
PID 4328 wrote to memory of 1356	4328	cmd.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:5452
- C:\Windows\system32\cmd.exe
  cmd /c title "Windows Host Process"
  2⤵
  - Executes a command shell one-liner
  PID:4820
- C:\Windows\system32\cmd.exe
  cmd /c "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"HostService\" /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5160
- - C:\Windows\system32\reg.exe
    reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"HostService\" /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" /f
    3⤵
    PID:1720
- C:\Windows\system32\cmd.exe
  cmd /c "schtasks /create /tn \"SystemUpdateTask\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" /sc ONLOGON /ru \"Admin\" /f /it"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"SystemUpdateTask\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" /sc ONLOGON /ru \"Admin\" /f /it
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1456

C:\Users\Admin\AppData\Local\Temp\2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\system32\cmd.exe
  cmd /c title "Windows Host Process"
  2⤵
  - Executes a command shell one-liner
  PID:4736
- C:\Windows\system32\cmd.exe
  cmd /c "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"HostService\" /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\system32\reg.exe
    reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"HostService\" /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" /f
    3⤵
    PID:2104
- C:\Windows\system32\cmd.exe
  cmd /c "schtasks /create /tn \"SystemUpdateTask\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" /sc ONLOGON /ru \"Admin\" /f /it"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"SystemUpdateTask\" /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-18_2bfb3e1d27aa1b64af00575544c22917_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" /sc ONLOGON /ru \"Admin\" /f /it
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysupd.log

Path C:\Users\Admin\AppData\Local\Temp\sysupd.log
Size 502B
SHA256 e780bd49077b53d5febba14d28abda5753855b904218dbd500a9e94ecb85c244
MD5 cd06177b924bb2b5f6a947b5bdf5669c
SHA1 f4d410b7d4e1b94321eae5a7d165d33a8ab62e2f
SHA512 ae27409b6e13f8417205d2d42ee0f301960c241b38085bb963d4148e0cca912ae28606ecfd20623bb2f321752747787e2a0483ed420afd25fbc63d7f3fa83916
TLSH
T181F0F81263B925BB5A4A1721C021BF3FD795F34BE14DCD08F6AA64590777C6A092E418
MD5 SHA1 SHA512 TLSH

Submit Download

sysupd.log

Path C:\Users\Admin\AppData\Local\Temp\sysupd.log
Size 548B
SHA256 55c66f2cbef37b80842f72eb8e7dab4e3699dd1e4b89764405951eb9c5224849
MD5 a0b8cd051a8ca7065703ab54849cb78c
SHA1 e91a19855bfc65204034563649f21c040eef6fe3
SHA512 d46315c934712477857fc6f3a8c6bcfb1d4a7351e69a0d7898d003efe7331748314c83877c5db166773d29da6c6c1269c6dfe22115f305a649931fb857731bce
TLSH
T1EBF0171263B825BB5A4A2712C011BE3FD7A5F34BE10CCC0CF6AA64590767C6A092E418
MD5 SHA1 SHA512 TLSH

Submit Download

HostService.url

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HostService.url
Size 328B
SHA256 5085bae2409185bae1b88a89ef27bf8c9b21a8b7a25e990dde690fac7538a0e5
MD5 ebc51a75755f33ba888396db5d05ff1f
SHA1 37aebb46165d2645eb63a60ccd140500c97951c1
SHA512 c7fa15e5b7d9fc83dd94131d54f4a9b9645645359cacbcea7e4587cdd675a5546e8c9f6a4fbdb0af95a7d7e9c4aa9aa0fa84308af997300b9a07129d568f7a42
TLSH
T130E026704A4AEF26C80BD01B92528D8EC8A662EFB4AC0A01D338D8CC29B294B59C5211
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\OverloadOps\config.json
Size 353B
SHA256 ee8f745b0d65ae7c5474bb48b6efe5fc751e5b4b348d5957531bdd5a56fa2973
MD5 6f29a282b66db6988ca98db142ad7f9e
SHA1 caa250d1910289f2a49e60a143c92e69b05af0cd
SHA512 622bde0e1081ae09f7c559a9b103e5475e84aaa52cd0a33c133bcd07741fc2344b510a34db709fae6bd61ac07ea7c53f7946c25014f4fb214bd4bb16a5cb75c4
TLSH
T16EE0268BC9450C6740C4A3712273550E2883F14B5C11380AF340E73E0F4C1ABA7B498E
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads