3a1e34755ebb84f9f7ceb1d57482edc463bbd409ac864206f119a8587935adc8

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 22:24

Target
2026-07-30_7db51128b6144e6f5ec2fa5f072f7d4c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 10.4MB
Sample260730-2bmesa1xex
SHA256 3a1e34755ebb84f9f7ceb1d57482edc463bbd409ac864206f119a8587935adc8
MD5 7db51128b6144e6f5ec2fa5f072f7d4c
SHA1 bb5f9e91214769555a2dd1394210ed8ea72dd2e1
SHA512 56119e08e07df8c82348fab99e258f2f86fe049594cc59da4a3a85d738d6f518a885e388badc273ef6d6e994ba03646e62d5cd6d54d688103486f5bea6772e5e
SSDEEP 49152:1HO20fLXRYYcu38HC29qYqf1V+C75b4xEEV3FHk8FdPP4ylEy6O+Xor+l5HVilDB:1H7mDU4H9oMXoqHLkVttbu4AhLBEf
TLSH
T190B64947ECA511E9C0ADD176C6669693BB713C884B3063D36B50F7242F36BD0AEBA740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

flow	ioc
3	ip-api.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

pid	Process
3076	tasklist.exe
2136	tasklist.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

pid	Process
5976	cmd.exe
4832	netsh.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3076	tasklist.exe
Token: SeDebugPrivilege	2136	tasklist.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 4420	4728	2026-07-30_7db51128b6144e6f5ec2fa5f072f7d4c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	85
PID 4728 wrote to memory of 5748	4728	2026-07-30_7db51128b6144e6f5ec2fa5f072f7d4c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	86
PID 5748 wrote to memory of 2136	5748	cmd.exe	89
PID 4420 wrote to memory of 3076	4420	cmd.exe	90
PID 4728 wrote to memory of 5976	4728	2026-07-30_7db51128b6144e6f5ec2fa5f072f7d4c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 5976 wrote to memory of 4832	5976	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-30_7db51128b6144e6f5ec2fa5f072f7d4c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_7db51128b6144e6f5ec2fa5f072f7d4c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\system32\cmd.exe
  cmd /C "tasklist /fi \"IMAGENAME eq msedge.exe\" /nh"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\system32\tasklist.exe
    tasklist /fi \"IMAGENAME eq msedge.exe\" /nh
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3076
- C:\Windows\system32\cmd.exe
  cmd /C "tasklist /fi \"IMAGENAME eq chrome.exe\" /nh"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5748
- - C:\Windows\system32\tasklist.exe
    tasklist /fi \"IMAGENAME eq chrome.exe\" /nh
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2136
- C:\Windows\system32\cmd.exe
  cmd /C "netsh wlan show profiles"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:5976
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4832