Overview

overview

3

Static

static

3

2026-07-27...ch.exe

windows10-2004-x64

1

2026-07-27...ch.exe

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 01:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_1398c84425d97ca85207218df835b393_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 6.6MB
  • Sample260727-btkqsstfrd
  • SHA256 a0a618c5d0c70c9a482288f0c7325164c2d2e900fee6af330efb866f9faa8f66
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
defense_evasionexecutionpersistence

Malware Config

Signatures

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_1398c84425d97ca85207218df835b393_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_1398c84425d97ca85207218df835b393_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Windows\system32\schtasks.exe
      schtasks /query /tn ProxiesPeer
      2⤵
        PID:1584
      • C:\Windows\system32\schtasks.exe
        schtasks /create /tn ProxiesPeer /tr \"C:\Users\Admin\AppData\Local\Temp\2026-07-27_1398c84425d97ca85207218df835b393_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" /sc onstart /ru SYSTEM /rl HIGHEST /f
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5924
    • C:\Users\Admin\AppData\Local\Temp\2026-07-27_1398c84425d97ca85207218df835b393_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-27_1398c84425d97ca85207218df835b393_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM 2026-07-27_1398c84425d97ca85207218df835b393_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe /FI "PID ne 2560"
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4604
      • C:\Windows\system32\schtasks.exe
        schtasks /query /tn ProxiesPeer
        2⤵
          PID:2804

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            machine-id
            • Path C:\ProgramData\proxies-peer\machine-id
            • Size 12B
            • SHA256 33b7b1496f219b6d10694bb54e00eab6004d9d449b239905779bd148d6b47547
            • MD5 SHA1 SHA512
            Submit Download

            peer.log
            • Path C:\ProgramData\proxies-peer\peer.log
            • Size 161B
            • SHA256 206b58edee41d427e23132ba0454be2b301135b1e809de80ea9a7eb06550e502
            • MD5 SHA1 SHA512 TLSH
            Submit Download