e5a5ab24e2c6e6ca4127883c6e1df418148a718f9cf28fe960731c824e54d460

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 07:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_8e713bd373c802ae1e0af2d4ccb6b33b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 6.5MB
Sample260724-jjbddavdrc
SHA256 e5a5ab24e2c6e6ca4127883c6e1df418148a718f9cf28fe960731c824e54d460
MD5 8e713bd373c802ae1e0af2d4ccb6b33b
SHA1 44f5e9f5711b08e6a9ca894b50b95dfb5a66c8e6
SHA512 2ff6f3be4c01eb4bcc4a4cbdffbf49b914ed43822bd669132a5c911b9b04a937416e0e667a390fb895191f11e19dabfd87813e5241b5a3ebd3fb30859b4f3096
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8s:T6BJUoROZfIA8Xf8xumvBh8huTEEm/
TLSH
T1CC665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5320	powershell.exe
3020	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4740	svchost_task.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\svchost_task.exe"	2026-07-24_8e713bd373c802ae1e0af2d4ccb6b33b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\svchost_task.exe"	svchost_task.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5320	powershell.exe
5320	powershell.exe
3020	powershell.exe
3020	powershell.exe
3020	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	5320	powershell.exe
Token: SeIncreaseQuotaPrivilege	5320	powershell.exe
Token: SeSecurityPrivilege	5320	powershell.exe
Token: SeTakeOwnershipPrivilege	5320	powershell.exe
Token: SeLoadDriverPrivilege	5320	powershell.exe
Token: SeSystemProfilePrivilege	5320	powershell.exe
Token: SeSystemtimePrivilege	5320	powershell.exe
Token: SeProfSingleProcessPrivilege	5320	powershell.exe
Token: SeIncBasePriorityPrivilege	5320	powershell.exe
Token: SeCreatePagefilePrivilege	5320	powershell.exe
Token: SeBackupPrivilege	5320	powershell.exe
Token: SeRestorePrivilege	5320	powershell.exe
Token: SeShutdownPrivilege	5320	powershell.exe
Token: SeDebugPrivilege	5320	powershell.exe
Token: SeSystemEnvironmentPrivilege	5320	powershell.exe
Token: SeRemoteShutdownPrivilege	5320	powershell.exe
Token: SeUndockPrivilege	5320	powershell.exe
Token: SeManageVolumePrivilege	5320	powershell.exe
Token: 33	5320	powershell.exe
Token: 34	5320	powershell.exe
Token: 35	5320	powershell.exe
Token: 36	5320	powershell.exe
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeIncreaseQuotaPrivilege	3020	powershell.exe
Token: SeSecurityPrivilege	3020	powershell.exe
Token: SeTakeOwnershipPrivilege	3020	powershell.exe
Token: SeLoadDriverPrivilege	3020	powershell.exe
Token: SeSystemProfilePrivilege	3020	powershell.exe
Token: SeSystemtimePrivilege	3020	powershell.exe
Token: SeProfSingleProcessPrivilege	3020	powershell.exe
Token: SeIncBasePriorityPrivilege	3020	powershell.exe
Token: SeCreatePagefilePrivilege	3020	powershell.exe
Token: SeBackupPrivilege	3020	powershell.exe
Token: SeRestorePrivilege	3020	powershell.exe
Token: SeShutdownPrivilege	3020	powershell.exe
Token: SeDebugPrivilege	3020	powershell.exe
Token: SeSystemEnvironmentPrivilege	3020	powershell.exe
Token: SeRemoteShutdownPrivilege	3020	powershell.exe
Token: SeUndockPrivilege	3020	powershell.exe
Token: SeManageVolumePrivilege	3020	powershell.exe
Token: 33	3020	powershell.exe
Token: 34	3020	powershell.exe
Token: 35	3020	powershell.exe
Token: 36	3020	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 5320	4116	2026-07-24_8e713bd373c802ae1e0af2d4ccb6b33b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 4740 wrote to memory of 3020	4740	svchost_task.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-24_8e713bd373c802ae1e0af2d4ccb6b33b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_8e713bd373c802ae1e0af2d4ccb6b33b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5320

C:\Users\Admin\AppData\Roaming\svchost_task.exe
C:\Users\Admin\AppData\Roaming\svchost_task.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Size 78KB
SHA256 f72e40de268ff0ba208c3b320afd72a570f5983342faffdc60838d0ca35d6f71
MD5 54f7989d612e8ca3ce253a2bb100d962
SHA1 f040f189fd62396320386b5ab8436eb9dd344fe6
SHA512 a0e4bce557ae53392096bdfe477f949606925eefb36644007ea39f29f4710f6526177c4ae003d375cfea2fb5b51641653728c054a053d5b67ba75c581c4a709a
SSDEEP 1536:aZ1Qnm+CLJNeogarTdLngQg32kLN0T+d17TJ/Evq1us9mGB4TBu:y1X+C8aHdLgQgmkLNx1TxEvq1B9TeTBu
TLSH
T12B7302BC6B01096A9BD014B9346E3FCAC513E65DD23D5BC219656B0DE49908CF23F47B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Size 328B
SHA256 0bf7511b9924fee3e36d97a10b5e19fe50210427ea67a6148b14968ab3a9b086
MD5 e4b9257b4d01a78646b440a90affa399
SHA1 08d6875f9206de1010e4ea7ba787a22258db8ef5
SHA512 5acce7d1f0f22282fa2beb1b73be153f073b87cf2689443089217f059742a27c29af32e808584a7f77e0bfdf5ac1e1196acb0f96c8797f9e877586b28c667714
TLSH
T1F0E0A725BBA80200F6730B3C9A626691457772665901C2890739944C1C6BF13ED77736
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lew5mmbg.wqh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lew5mmbg.wqh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

svchost_task.exe

Path C:\Users\Admin\AppData\Roaming\svchost_task.exe
Size 6.5MB
SHA256 78fcac19a9626be8b697795af1ff0dd9e1f84e1995027803ae69fec7dbb766ff
MD5 bca4a1a303b0c86b5a7869dca6dcc29b
SHA1 ad00ee431c679cc7c3f4a43ddb4839f55b80b2d3
SHA512 ede34540dd986a70be8d5da100ee74e9204b2a5bbb1fbde266c41290d4466a707f832e28c01f915f8b416a2078dc15f4fceabbbb966bf5795c30e43fecf67fbc
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8C:T6BJUoROZfIA8Xf8xumvBh8huTEEm/
TLSH
T18C665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3020-36-0x000002D14D5D0000-0x000002D14D6C0000-memory.dmp

Download

memory/3020-34-0x000002D14D2C0000-0x000002D14D372000-memory.dmp

Download

memory/5320-16-0x0000017176E20000-0x0000017176ED2000-memory.dmp

Download

memory/5320-20-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5320-11-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5320-12-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5320-15-0x0000017176B80000-0x0000017176B9E000-memory.dmp

Download

memory/5320-0-0x00007FF8EA99F000-0x00007FF8EA9A0000-memory.dmp

Download

memory/5320-17-0x0000017176BA0000-0x0000017176BAA000-memory.dmp

Download

memory/5320-18-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5320-19-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5320-10-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5320-21-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5320-23-0x0000017177130000-0x0000017177220000-memory.dmp

Download

memory/5320-24-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5320-9-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5320-8-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5320-7-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5320-6-0x0000017176AD0000-0x0000017176AF2000-memory.dmp

Download

memory/5320-3-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5320-2-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/5320-1-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download