6c36a14d7cedba61d0c203671467bed263783fd105669772846a21018e81e75d

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 05:53

Target
2026-07-22_55091453aab7bf6645f75a24d0c0e785_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 10.3MB
Sample260722-gljfnabb56
SHA256 6c36a14d7cedba61d0c203671467bed263783fd105669772846a21018e81e75d
MD5 55091453aab7bf6645f75a24d0c0e785
SHA1 9b4f0a9c67b45ab9ec32c14a4af2edda75f285a1
SHA512 1914aa6d43c4353b57fde96bb303375af5357a7aa4ad82b41bda6ba5f067e39e221a5bba889d7dd2a53cdcfcb463f58e4fa212b52855191ad5f9c1faf835a985
SSDEEP 98304:oymlu2MMdlPK3GNDUwlcEcX+3PiCx67+CxIrsOfRkLys1Di4rH:oTRY3MDVVMudfbmDP
TLSH
T11BB67D03FC6554E9C1AD923189B292537B717C880B3227D72B50F6386F76BD0AEBA354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4132	winmon.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WinMon\winmon.exe	2026-07-22_55091453aab7bf6645f75a24d0c0e785_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4060	2026-07-22_55091453aab7bf6645f75a24d0c0e785_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
4132	winmon.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 2292	4060	2026-07-22_55091453aab7bf6645f75a24d0c0e785_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-22_55091453aab7bf6645f75a24d0c0e785_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_55091453aab7bf6645f75a24d0c0e785_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Users\Admin\AppData\Local\Temp\2026-07-22_55091453aab7bf6645f75a24d0c0e785_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-22_55091453aab7bf6645f75a24d0c0e785_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe" -service install
  2⤵
  - Drops file in Program Files directory
  PID:2292

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

winmon.exe

Path C:\Program Files\WinMon\winmon.exe
Size 10.3MB
SHA256 6c36a14d7cedba61d0c203671467bed263783fd105669772846a21018e81e75d
MD5 55091453aab7bf6645f75a24d0c0e785
SHA1 9b4f0a9c67b45ab9ec32c14a4af2edda75f285a1
SHA512 1914aa6d43c4353b57fde96bb303375af5357a7aa4ad82b41bda6ba5f067e39e221a5bba889d7dd2a53cdcfcb463f58e4fa212b52855191ad5f9c1faf835a985
SSDEEP 98304:oymlu2MMdlPK3GNDUwlcEcX+3PiCx67+CxIrsOfRkLys1Di4rH:oTRY3MDVVMudfbmDP
TLSH
T11BB67D03FC6554E9C1AD923189B292537B717C880B3227D72B50F6386F76BD0AEBA354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download