Overview

overview

3

Static

static

3

2026-07-27...ch.exe

windows10-2004-x64

1

2026-07-27...ch.exe

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/07/2026, 01:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_1398c84425d97ca85207218df835b393_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 6.6MB
  • Sample260727-btkqsstfrd
  • SHA256 a0a618c5d0c70c9a482288f0c7325164c2d2e900fee6af330efb866f9faa8f66
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
defense_evasionexecutionpersistence

Malware Config

Signatures

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_1398c84425d97ca85207218df835b393_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_1398c84425d97ca85207218df835b393_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:536
    • C:\Windows\system32\schtasks.exe
      schtasks /query /tn ProxiesPeer
      2⤵
        PID:1696
      • C:\Windows\system32\schtasks.exe
        schtasks /create /tn ProxiesPeer /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-27_1398c84425d97ca85207218df835b393_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" /sc onstart /ru SYSTEM /rl HIGHEST /f
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4872
    • C:\Users\Admin\AppData\Local\Temp\2026-07-27_1398c84425d97ca85207218df835b393_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-27_1398c84425d97ca85207218df835b393_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2092
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM 2026-07-27_1398c84425d97ca85207218df835b393_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /FI "PID ne 2092"
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4860
      • C:\Windows\system32\schtasks.exe
        schtasks /query /tn ProxiesPeer
        2⤵
          PID:2784

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            machine-id
            • Path C:\ProgramData\proxies-peer\machine-id
            • Size 12B
            • SHA256 add05bb863c6c9934f8bb8f06d8ac36f8a3806fe4a40e3bf6668a39f40eb9318
            • MD5 SHA1 SHA512
            Submit Download

            peer.log
            • Path C:\ProgramData\proxies-peer\peer.log
            • Size 161B
            • SHA256 d160701b9750fe11e7240ba95f8bcf2f92e6319809f821cb481f08e4b28528da
            • MD5 SHA1 SHA512 TLSH
            Submit Download