5663d8334fc9e4038df8585a07fccf5ac6f18d8bcb791d16da9aa088f226446f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_e8147e093ddc464b00766e3cbcf98b46_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 10.1MB
Sample260723-3rd9sadj8t
SHA256 5663d8334fc9e4038df8585a07fccf5ac6f18d8bcb791d16da9aa088f226446f
MD5 e8147e093ddc464b00766e3cbcf98b46
SHA1 6ed3e6e70b8abbdb5f01b4c7feb59f46d51c9a65
SHA512 4ea93577ab02704cad1473ed4ddb874a49ed6589aed8be74c0fa46bffbf487d6c8eb9c1785ed6636eb94b51aa9e1153ad82dff59901acde0a4694a83cd0b94cd
SSDEEP 98304:1HzEjMihshthYwI+RxEbzqQbegsoFqsDDIAXGbVlz/qLwpDn:dwYwoYwIdbXymDD8xlzKwV
TLSH
T19CB67C03EDA528E9C1ADA2318AB396537B717C490B3263D71B90F6343E76BE06D79344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	824	powershell.exe
23	824	powershell.exe
30	824	powershell.exe
38	4004	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3080	powershell.exe
824	powershell.exe
4004	powershell.exe
3080	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
76	discord.com
77	discord.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
37	icanhazip.com
38	icanhazip.com
6	api.ipify.org

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
788	2026-07-23_e8147e093ddc464b00766e3cbcf98b46_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3592	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
728	wmic.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3080	powershell.exe
3080	powershell.exe
824	powershell.exe
824	powershell.exe
4004	powershell.exe
4004	powershell.exe
788	2026-07-23_e8147e093ddc464b00766e3cbcf98b46_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
788	2026-07-23_e8147e093ddc464b00766e3cbcf98b46_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3080	powershell.exe
Token: SeIncreaseQuotaPrivilege	728	wmic.exe
Token: SeSecurityPrivilege	728	wmic.exe
Token: SeTakeOwnershipPrivilege	728	wmic.exe
Token: SeLoadDriverPrivilege	728	wmic.exe
Token: SeSystemProfilePrivilege	728	wmic.exe
Token: SeSystemtimePrivilege	728	wmic.exe
Token: SeProfSingleProcessPrivilege	728	wmic.exe
Token: SeIncBasePriorityPrivilege	728	wmic.exe
Token: SeCreatePagefilePrivilege	728	wmic.exe
Token: SeBackupPrivilege	728	wmic.exe
Token: SeRestorePrivilege	728	wmic.exe
Token: SeShutdownPrivilege	728	wmic.exe
Token: SeDebugPrivilege	728	wmic.exe
Token: SeSystemEnvironmentPrivilege	728	wmic.exe
Token: SeRemoteShutdownPrivilege	728	wmic.exe
Token: SeUndockPrivilege	728	wmic.exe
Token: SeManageVolumePrivilege	728	wmic.exe
Token: 33	728	wmic.exe
Token: 34	728	wmic.exe
Token: 35	728	wmic.exe
Token: 36	728	wmic.exe
Token: SeIncreaseQuotaPrivilege	728	wmic.exe
Token: SeSecurityPrivilege	728	wmic.exe
Token: SeTakeOwnershipPrivilege	728	wmic.exe
Token: SeLoadDriverPrivilege	728	wmic.exe
Token: SeSystemProfilePrivilege	728	wmic.exe
Token: SeSystemtimePrivilege	728	wmic.exe
Token: SeProfSingleProcessPrivilege	728	wmic.exe
Token: SeIncBasePriorityPrivilege	728	wmic.exe
Token: SeCreatePagefilePrivilege	728	wmic.exe
Token: SeBackupPrivilege	728	wmic.exe
Token: SeRestorePrivilege	728	wmic.exe
Token: SeShutdownPrivilege	728	wmic.exe
Token: SeDebugPrivilege	728	wmic.exe
Token: SeSystemEnvironmentPrivilege	728	wmic.exe
Token: SeRemoteShutdownPrivilege	728	wmic.exe
Token: SeUndockPrivilege	728	wmic.exe
Token: SeManageVolumePrivilege	728	wmic.exe
Token: 33	728	wmic.exe
Token: 34	728	wmic.exe
Token: 35	728	wmic.exe
Token: 36	728	wmic.exe
Token: SeDebugPrivilege	824	powershell.exe
Token: SeDebugPrivilege	4004	powershell.exe
Token: SeIncreaseQuotaPrivilege	540	wmic.exe
Token: SeSecurityPrivilege	540	wmic.exe
Token: SeTakeOwnershipPrivilege	540	wmic.exe
Token: SeLoadDriverPrivilege	540	wmic.exe
Token: SeSystemProfilePrivilege	540	wmic.exe
Token: SeSystemtimePrivilege	540	wmic.exe
Token: SeProfSingleProcessPrivilege	540	wmic.exe
Token: SeIncBasePriorityPrivilege	540	wmic.exe
Token: SeCreatePagefilePrivilege	540	wmic.exe
Token: SeBackupPrivilege	540	wmic.exe
Token: SeRestorePrivilege	540	wmic.exe
Token: SeShutdownPrivilege	540	wmic.exe
Token: SeDebugPrivilege	540	wmic.exe
Token: SeSystemEnvironmentPrivilege	540	wmic.exe
Token: SeRemoteShutdownPrivilege	540	wmic.exe
Token: SeUndockPrivilege	540	wmic.exe
Token: SeManageVolumePrivilege	540	wmic.exe
Token: 33	540	wmic.exe
Token: 34	540	wmic.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 3080	788	2026-07-23_e8147e093ddc464b00766e3cbcf98b46_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	85
PID 788 wrote to memory of 728	788	2026-07-23_e8147e093ddc464b00766e3cbcf98b46_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	86
PID 788 wrote to memory of 824	788	2026-07-23_e8147e093ddc464b00766e3cbcf98b46_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 788 wrote to memory of 4004	788	2026-07-23_e8147e093ddc464b00766e3cbcf98b46_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 788 wrote to memory of 540	788	2026-07-23_e8147e093ddc464b00766e3cbcf98b46_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	97
PID 788 wrote to memory of 752	788	2026-07-23_e8147e093ddc464b00766e3cbcf98b46_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	98
PID 788 wrote to memory of 3592	788	2026-07-23_e8147e093ddc464b00766e3cbcf98b46_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-23_e8147e093ddc464b00766e3cbcf98b46_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_e8147e093ddc464b00766e3cbcf98b46_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\2026-07-23_e8147e093ddc464b00766e3cbcf98b46_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3080
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_videocontroller get name
  2⤵
  - Detects videocard installed
  - Suspicious use of AdjustPrivilegeToken
  PID:728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing).Content"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Invoke-WebRequest -Uri 'https://icanhazip.com' -UseBasicParsing).Content"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4004
- C:\Windows\System32\Wbem\wmic.exe
  wmic /namespace:\\root\securitycenter2 path antivirusproduct get displayname
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:540
- C:\Windows\System32\Wbem\wmic.exe
  wmic product get name
  2⤵
  PID:752
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:3592

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:3588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 63f3369719ec0f4063138a71ba369a25fb4824bc035eaa4072ee6a5a1812480a
MD5 e7d0883e28000a6270cf6b3b3f7b6c5a
SHA1 74d916eb15baa5ce4a168cd80d3d2c45d503daa2
SHA512 4b4ade064020959bc677689fa658816c8c498c8117df70a1ae4076533972593b4e2c3bf45d39e28662892e12db07641f14870ef69292e81030f8b3d7c92302f1
TLSH
T1C5112223F38C8920CC96163A509DAC5172B596CB81EEDF9F7FC0D210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3c1490d1ce2e5fa07cf3288840fe03b171c3cf019e39101dc8c381a6d384ab80
MD5 e79ef4941471e3895001a62d1b85b9d8
SHA1 15ddb3d28802b470286b374e45f355249fe7c285
SHA512 17ea4a5045e36086260027fefe93da17973ad0bdbb56a2d6d1ea1967a6d8fc0c305c0d17b2b265f80bb75a96da600ccd41ca0fc6fea5b56b397fdcfa3b93dc90
TLSH
T1A9119723B39C89A1CC86113A409D9C1136B783CB40AECEDF6FC0C214A1BF584CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dqvrrxbh.p1i.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dqvrrxbh.p1i.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH