3a1e34755ebb84f9f7ceb1d57482edc463bbd409ac864206f119a8587935adc8

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 22:24

Target
2026-07-30_7db51128b6144e6f5ec2fa5f072f7d4c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 10.4MB
Sample260730-2bmesa1xex
SHA256 3a1e34755ebb84f9f7ceb1d57482edc463bbd409ac864206f119a8587935adc8
MD5 7db51128b6144e6f5ec2fa5f072f7d4c
SHA1 bb5f9e91214769555a2dd1394210ed8ea72dd2e1
SHA512 56119e08e07df8c82348fab99e258f2f86fe049594cc59da4a3a85d738d6f518a885e388badc273ef6d6e994ba03646e62d5cd6d54d688103486f5bea6772e5e
SSDEEP 49152:1HO20fLXRYYcu38HC29qYqf1V+C75b4xEEV3FHk8FdPP4ylEy6O+Xor+l5HVilDB:1H7mDU4H9oMXoqHLkVttbu4AhLBEf
TLSH
T190B64947ECA511E9C0ADD176C6669693BB713C884B3063D36B50F7242F36BD0AEBA740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

flow	ioc
1	ip-api.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

pid	Process
5884	tasklist.exe
5996	tasklist.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

pid	Process
4496	cmd.exe
3436	netsh.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5996	tasklist.exe
Token: SeDebugPrivilege	5884	tasklist.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 3120	3940	2026-07-30_7db51128b6144e6f5ec2fa5f072f7d4c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	90
PID 3940 wrote to memory of 6320	3940	2026-07-30_7db51128b6144e6f5ec2fa5f072f7d4c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 3120 wrote to memory of 5996	3120	cmd.exe	94
PID 6320 wrote to memory of 5884	6320	cmd.exe	95
PID 3940 wrote to memory of 4496	3940	2026-07-30_7db51128b6144e6f5ec2fa5f072f7d4c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 4496 wrote to memory of 3436	4496	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-07-30_7db51128b6144e6f5ec2fa5f072f7d4c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_7db51128b6144e6f5ec2fa5f072f7d4c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\system32\cmd.exe
  cmd /C "tasklist /fi \"IMAGENAME eq msedge.exe\" /nh"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\system32\tasklist.exe
    tasklist /fi \"IMAGENAME eq msedge.exe\" /nh
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5996
- C:\Windows\system32\cmd.exe
  cmd /C "tasklist /fi \"IMAGENAME eq chrome.exe\" /nh"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6320
- - C:\Windows\system32\tasklist.exe
    tasklist /fi \"IMAGENAME eq chrome.exe\" /nh
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5884
- C:\Windows\system32\cmd.exe
  cmd /C "netsh wlan show profiles"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3436