27546a4e03a0dd5006b657067b9d49398274124c6dbdd5e41390d3057cf46e3c

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_0f91adea1d6b6e3d7a3a6628daa8b242_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 31.3MB
Sample260721-wbd6hsdc82
SHA256 27546a4e03a0dd5006b657067b9d49398274124c6dbdd5e41390d3057cf46e3c
MD5 0f91adea1d6b6e3d7a3a6628daa8b242
SHA1 f0aa9cb1029f90ac48e54d5ed35aa22267152475
SHA512 e7ac86d21b59f436eb8d4d8773864bf25f1b6e5afc6afedcfdf14f3e26b1cb22e33844610e4263e24af5368fd2c564f8ac9246a57a21ce2b2554d47d1ff39f40
SSDEEP 196608:EvtFt2VOydGOKlxNPG92Re2MKP9p3nI6v1m:EFFt2VOjxi2Re2M29lnB1m
TLSH
T100773A63F8D22984D4AAC574C672813BBB613C590B7823E75790F7201F3ABD0DAB6752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5760	powershell.exe
3360	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-630870345.tmp	2026-07-21_0f91adea1d6b6e3d7a3a6628daa8b242_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-1665341233.tmp	ovd_27bff2c36aa8.exe

Executes dropped EXE 1 IoCs

pid	Process
4716	ovd_27bff2c36aa8.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoylordAgent-60b49b30 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_27bff2c36aa8.exe\""	2026-07-21_0f91adea1d6b6e3d7a3a6628daa8b242_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoylordAgent-e17e5e66 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_27bff2c36aa8.exe\""	ovd_27bff2c36aa8.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\config\settings.json	ovd_27bff2c36aa8.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5760	powershell.exe
5760	powershell.exe
3360	powershell.exe
3360	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4216	2026-07-21_0f91adea1d6b6e3d7a3a6628daa8b242_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Token: SeDebugPrivilege	5760	powershell.exe
Token: SeIncreaseQuotaPrivilege	5760	powershell.exe
Token: SeSecurityPrivilege	5760	powershell.exe
Token: SeTakeOwnershipPrivilege	5760	powershell.exe
Token: SeLoadDriverPrivilege	5760	powershell.exe
Token: SeSystemProfilePrivilege	5760	powershell.exe
Token: SeSystemtimePrivilege	5760	powershell.exe
Token: SeProfSingleProcessPrivilege	5760	powershell.exe
Token: SeIncBasePriorityPrivilege	5760	powershell.exe
Token: SeCreatePagefilePrivilege	5760	powershell.exe
Token: SeBackupPrivilege	5760	powershell.exe
Token: SeRestorePrivilege	5760	powershell.exe
Token: SeShutdownPrivilege	5760	powershell.exe
Token: SeDebugPrivilege	5760	powershell.exe
Token: SeSystemEnvironmentPrivilege	5760	powershell.exe
Token: SeRemoteShutdownPrivilege	5760	powershell.exe
Token: SeUndockPrivilege	5760	powershell.exe
Token: SeManageVolumePrivilege	5760	powershell.exe
Token: 33	5760	powershell.exe
Token: 34	5760	powershell.exe
Token: 35	5760	powershell.exe
Token: 36	5760	powershell.exe
Token: SeIncreaseQuotaPrivilege	5760	powershell.exe
Token: SeSecurityPrivilege	5760	powershell.exe
Token: SeTakeOwnershipPrivilege	5760	powershell.exe
Token: SeLoadDriverPrivilege	5760	powershell.exe
Token: SeSystemProfilePrivilege	5760	powershell.exe
Token: SeSystemtimePrivilege	5760	powershell.exe
Token: SeProfSingleProcessPrivilege	5760	powershell.exe
Token: SeIncBasePriorityPrivilege	5760	powershell.exe
Token: SeCreatePagefilePrivilege	5760	powershell.exe
Token: SeBackupPrivilege	5760	powershell.exe
Token: SeRestorePrivilege	5760	powershell.exe
Token: SeShutdownPrivilege	5760	powershell.exe
Token: SeDebugPrivilege	5760	powershell.exe
Token: SeSystemEnvironmentPrivilege	5760	powershell.exe
Token: SeRemoteShutdownPrivilege	5760	powershell.exe
Token: SeUndockPrivilege	5760	powershell.exe
Token: SeManageVolumePrivilege	5760	powershell.exe
Token: 33	5760	powershell.exe
Token: 34	5760	powershell.exe
Token: 35	5760	powershell.exe
Token: 36	5760	powershell.exe
Token: SeIncreaseQuotaPrivilege	5760	powershell.exe
Token: SeSecurityPrivilege	5760	powershell.exe
Token: SeTakeOwnershipPrivilege	5760	powershell.exe
Token: SeLoadDriverPrivilege	5760	powershell.exe
Token: SeSystemProfilePrivilege	5760	powershell.exe
Token: SeSystemtimePrivilege	5760	powershell.exe
Token: SeProfSingleProcessPrivilege	5760	powershell.exe
Token: SeIncBasePriorityPrivilege	5760	powershell.exe
Token: SeCreatePagefilePrivilege	5760	powershell.exe
Token: SeBackupPrivilege	5760	powershell.exe
Token: SeRestorePrivilege	5760	powershell.exe
Token: SeShutdownPrivilege	5760	powershell.exe
Token: SeDebugPrivilege	5760	powershell.exe
Token: SeSystemEnvironmentPrivilege	5760	powershell.exe
Token: SeRemoteShutdownPrivilege	5760	powershell.exe
Token: SeUndockPrivilege	5760	powershell.exe
Token: SeManageVolumePrivilege	5760	powershell.exe
Token: 33	5760	powershell.exe
Token: 34	5760	powershell.exe
Token: 35	5760	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 5760	4716	ovd_27bff2c36aa8.exe	91
PID 4716 wrote to memory of 3360	4716	ovd_27bff2c36aa8.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-21_0f91adea1d6b6e3d7a3a6628daa8b242_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_0f91adea1d6b6e3d7a3a6628daa8b242_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_27bff2c36aa8.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_27bff2c36aa8.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_27bff2c36aa8.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_21bb1ae6' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'ovd_f21bb1ae6'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'ovd_c21bb1ae6'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_27bff2c36aa8.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='ovd_f21bb1ae6'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='ovd_c21bb1ae6'\"; $null = $b.Put()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jgkfyppw.dbv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jgkfyppw.dbv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent-2499316072.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\agent-2499316072.tmp
Size 31.3MB
SHA256 27546a4e03a0dd5006b657067b9d49398274124c6dbdd5e41390d3057cf46e3c
MD5 0f91adea1d6b6e3d7a3a6628daa8b242
SHA1 f0aa9cb1029f90ac48e54d5ed35aa22267152475
SHA512 e7ac86d21b59f436eb8d4d8773864bf25f1b6e5afc6afedcfdf14f3e26b1cb22e33844610e4263e24af5368fd2c564f8ac9246a57a21ce2b2554d47d1ff39f40
SSDEEP 196608:EvtFt2VOydGOKlxNPG92Re2MKP9p3nI6v1m:EFFt2VOjxi2Re2M29lnB1m
TLSH
T100773A63F8D22984D4AAC574C672813BBB613C590B7823E75790F7201F3ABD0DAB6752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3360-31-0x000001FAB1570000-0x000001FAB1660000-memory.dmp

Download

memory/5760-18-0x000001661AC50000-0x000001661AC72000-memory.dmp

Download

memory/5760-21-0x0000016632E20000-0x0000016632E3E000-memory.dmp

Download

memory/5760-22-0x0000016632E40000-0x0000016632EF2000-memory.dmp

Download

memory/5760-23-0x0000016633110000-0x000001663311A000-memory.dmp

Download

memory/5760-24-0x0000016633390000-0x00000166333AE000-memory.dmp

Download

memory/5760-26-0x0000016633370000-0x0000016633460000-memory.dmp

Download