737f78f0f470424e1f6f2634926209305eeccbad563393255e772b261c098054

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_93ece26d2cc563baa41c4fdce9a9b950_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 31.2MB
Sample260722-vzhyyazflg
SHA256 737f78f0f470424e1f6f2634926209305eeccbad563393255e772b261c098054
MD5 93ece26d2cc563baa41c4fdce9a9b950
SHA1 c7089edeb7562e79a9d7382c7e6d2d720cb720c6
SHA512 8d60b15cda2185ae0a9f330dd06f009a033e038ae232589dd1ec76f053b3cf47d6cb5c60b4a882fd77f820bb105e0ccd77056b0fbdd5aee2953b11c3c549f71e
SSDEEP 196608:g4+hl7lVDThopbHZDYFjPNfBuoS7vb+6iNU:gR7lVDTWRZDelBu57m2
TLSH
T1E0672967F89229C4D4EEC174C672813BBA6138290B3853F71690F7642F3ABD0DAB6751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2376	ovd_eeb0b0760eca.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoylordAgent-597dcefa = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_eeb0b0760eca.exe\""	2026-07-22_93ece26d2cc563baa41c4fdce9a9b950_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoylordAgent-668bea5f = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_eeb0b0760eca.exe\""	ovd_eeb0b0760eca.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\config\settings.json	ovd_eeb0b0760eca.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1792	2026-07-22_93ece26d2cc563baa41c4fdce9a9b950_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-22_93ece26d2cc563baa41c4fdce9a9b950_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_93ece26d2cc563baa41c4fdce9a9b950_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_eeb0b0760eca.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_eeb0b0760eca.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:2376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ovd_eeb0b0760eca.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_eeb0b0760eca.exe
Size 31.2MB
SHA256 737f78f0f470424e1f6f2634926209305eeccbad563393255e772b261c098054
MD5 93ece26d2cc563baa41c4fdce9a9b950
SHA1 c7089edeb7562e79a9d7382c7e6d2d720cb720c6
SHA512 8d60b15cda2185ae0a9f330dd06f009a033e038ae232589dd1ec76f053b3cf47d6cb5c60b4a882fd77f820bb105e0ccd77056b0fbdd5aee2953b11c3c549f71e
SSDEEP 196608:g4+hl7lVDThopbHZDYFjPNfBuoS7vb+6iNU:gR7lVDTWRZDelBu57m2
TLSH
T1E0672967F89229C4D4EEC174C672813BBA6138290B3853F71690F7642F3ABD0DAB6751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads