3169b268a59c642c42172c07e78df7559c732d1d628fbcb02ceebedb95e7a0ab

Analysis

max time kernel
150s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 03:42

Target
2026-07-27_cb58930c6d373f100d6220f3651458e9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 15.7MB
Sample260727-d9ssfsvwhy
SHA256 3169b268a59c642c42172c07e78df7559c732d1d628fbcb02ceebedb95e7a0ab
MD5 cb58930c6d373f100d6220f3651458e9
SHA1 12e514bde35e68d3fcbf70748b84edfda28a263a
SHA512 ae63dbe9fc42ac39324c1df8fba355138fdffdba6a0f26e7e021f6abdb6d46a232890bb1e5043bc84ff850cafb2be09a6037fafcafb785c48e90f9a36a0c3ffd
SSDEEP 98304:O6VO/ADPOfnBLl+0hpA944ZqwFD7VNU+p0pf6VDGMBiWtE:tUojORhS9zFD7vfGf6VaD
TLSH
T1CAF64947E9A609E9C4ADD131C57692237B717C495B3123D72B60B6283F36BD0AEFA700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

pid	Process
1948	netsh.exe
6296	netsh.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
8	api.ipify.org

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-27_cb58930c6d373f100d6220f3651458e9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-27_cb58930c6d373f100d6220f3651458e9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6636 wrote to memory of 1948	6636	2026-07-27_cb58930c6d373f100d6220f3651458e9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	90
PID 6636 wrote to memory of 6296	6636	2026-07-27_cb58930c6d373f100d6220f3651458e9_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92