38d265a22538e613c8bb42806e24a95f31aeb4a2338101802ccd6a0884a4b8e2

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_7cc95fb7cce2da27770f0b9381e8d4bc_coinminer_glassworm_snatch.exe
Size 4.4MB
Sample260730-dsyblsyckd
SHA256 38d265a22538e613c8bb42806e24a95f31aeb4a2338101802ccd6a0884a4b8e2
MD5 7cc95fb7cce2da27770f0b9381e8d4bc
SHA1 215bc9a1b48f007cca0971e7a357e9620354284d
SHA512 5a8c1ed74e776b4bb3c93fa5e4b086294e7bef3a8ec6c1c33b17655adb825bd8beabed35d42e60925ce50ef88c71a7d441c6ac1ff540636eb34f20f0a4d2269e
SSDEEP 49152:Ct9Tp3VD3XZTEKDo0ZFK2IoucN5ZnWRbp2Fhl64bRa2PVko5neehPnhdb:CtnlLZJDp7l02bhPn
TLSH
T1B2265A17FCA519E9C0AED2368A76A5227B707C481B3023E71B60B6343F76BD09DB9315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 35	2148	2026-07-30_7cc95fb7cce2da27770f0b9381e8d4bc_coinminer_glassworm_snatch.exe
Token: 35	2148	2026-07-30_7cc95fb7cce2da27770f0b9381e8d4bc_coinminer_glassworm_snatch.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 3792	2148	2026-07-30_7cc95fb7cce2da27770f0b9381e8d4bc_coinminer_glassworm_snatch.exe	90
PID 2148 wrote to memory of 4484	2148	2026-07-30_7cc95fb7cce2da27770f0b9381e8d4bc_coinminer_glassworm_snatch.exe	92
PID 4484 wrote to memory of 3152	4484	2026-07-30_7cc95fb7cce2da27770f0b9381e8d4bc_coinminer_glassworm_snatch.exe	94
PID 2148 wrote to memory of 2356	2148	2026-07-30_7cc95fb7cce2da27770f0b9381e8d4bc_coinminer_glassworm_snatch.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-30_7cc95fb7cce2da27770f0b9381e8d4bc_coinminer_glassworm_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_7cc95fb7cce2da27770f0b9381e8d4bc_coinminer_glassworm_snatch.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\2026-07-30_7cc95fb7cce2da27770f0b9381e8d4bc_coinminer_glassworm_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-30_7cc95fb7cce2da27770f0b9381e8d4bc_coinminer_glassworm_snatch.exe -test.run=^TestJobProcessHelper$ -- output
  2⤵
  PID:3792
- C:\Users\Admin\AppData\Local\Temp\2026-07-30_7cc95fb7cce2da27770f0b9381e8d4bc_coinminer_glassworm_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-30_7cc95fb7cce2da27770f0b9381e8d4bc_coinminer_glassworm_snatch.exe -test.run=^TestJobProcessHelper$ -- spawn
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Users\Admin\AppData\Local\Temp\2026-07-30_7cc95fb7cce2da27770f0b9381e8d4bc_coinminer_glassworm_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-30_7cc95fb7cce2da27770f0b9381e8d4bc_coinminer_glassworm_snatch.exe -test.run=^TestJobProcessHelper$ -- sleep
    3⤵
    PID:3152
- C:\Users\Admin\AppData\Local\Temp\2026-07-30_7cc95fb7cce2da27770f0b9381e8d4bc_coinminer_glassworm_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-30_7cc95fb7cce2da27770f0b9381e8d4bc_coinminer_glassworm_snatch.exe -test.run=^TestJobProcessHelper$ -- io
  2⤵
  PID:2356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

stage-000002.bin

Path C:\Users\Admin\AppData\Local\Temp\TestAtomicFileSystemCommitsAndFinalizesMultiFileTransaction787531456\001\.rails-transactions-ce0eb31e38a07f10\txn.basic\stage-000002.bin
Size 9B
SHA256 91fda4d39078f08f4840183f5f532cd072159ba3d09f7d93d59f5830fa43cee9
MD5 5ca71ca7e6ba97e06414d0bdfc6ac03b
SHA1 c81f12383341466e4c923eabfb900e768b58d9ab
SHA512 42cd1184240e444169ce013e461ac9fe2140f01152c8f4f9f712dc7daa0534ca953bafb156a6e62ad947bfb234427645e587f12c452fee39cc789ce7bdeafbb8
MD5 SHA1 SHA512

Submit Download

stage-000003.bin

Path C:\Users\Admin\AppData\Local\Temp\TestAtomicFileSystemCommitsAndFinalizesMultiFileTransaction787531456\001\.rails-transactions-ce0eb31e38a07f10\txn.basic\stage-000003.bin
Size 23B
SHA256 42e4ba283f5d80ce90a8030f21b5b6bd9ff4604ef1848a4b7b668c6a68171a50
MD5 850c8d74b12d19f3da2b969654a81c0c
SHA1 8865da13b8b5a7cfd929b324b2b82acfdb0b0ebe
SHA512 93cf233800ca3322ffedeb58e4afdbff9b116e522798aa61a2959884e857f84b09761b585def44e89677cf61ffdfd4f13ad48c97e9357ac6a5e06899882532f2
MD5 SHA1 SHA512

Submit Download

a.txt

Path C:\Users\Admin\AppData\Local\Temp\TestAtomicFileSystemDoesNotOverwriteEditorRace2939999144\001\repo\a.txt
Size 7B
SHA256 001941a763e192f660176a654132e05352a4dd7a276052e5f31821813425ae8f
MD5 0d44778d72ea6d6a2973b94567b56482
SHA1 584c090f67c3e26d818401a1d31d63e77e4772ed
SHA512 2565bd0961e47339a1085e2f0208423709adb4acc57dc0822b555e79b14aca4b3397e950d69a82b6e660e2f73d7381d0aa57dde53b0f41bfc8fdb0a2e3561456
MD5 SHA1 SHA512

Submit Download

stage-000000.bin

Path C:\Users\Admin\AppData\Local\Temp\TestAtomicFileSystemReturnsRecoverableHandleAfterDurablePrepareE2052517502\001\.rails-transactions-f33ec8fc3261e75b\txn.disk-full\stage-000000.bin
Size 8B
SHA256 0732c97eef85880f7cf628e0b7ade6151515ddb78793dbb88c9ee2ff18bb4af9
MD5 ff8fe59c43b95284c50c517e8ab558af
SHA1 b619301304b49bd4ae112572bfbe9b3547ae000b
SHA512 fddcaf7b66aed9ad0849070b1648415b742839b30f0789346431590baf23eff479330a094d06c1da45ddc9dd858fd01a86956baa00ef8220f56c383e9353aea5
MD5 SHA1 SHA512

Submit Download

a.txt

Path C:\Users\Admin\AppData\Local\Temp\TestAtomicFileSystemReturnsRecoverableHandleAfterDurablePrepareE2052517502\001\repo\a.txt
Size 9B
SHA256 021aad3bada42202b77dbee3563071ee6bed8a7183c9b2691854583e2d6bdbde
MD5 0931a9532622610f81bc1c9c4ded3784
SHA1 1e7cf59df3bb1f320777521ec6025b2944457108
SHA512 54e7569405c0c93059603797df7efd3461fce91c2bbb1f004a991bb1da454dda31d914b53a8fba3046c55a4ebfd4255066f60ab7ad576e81c54985be84e4321d
MD5 SHA1 SHA512

Submit Download

b.txt

Path C:\Users\Admin\AppData\Local\Temp\TestAtomicFileSystemReturnsRecoverableHandleAfterDurablePrepareE2052517502\001\repo\b.txt
Size 9B
SHA256 5fddadbcfe06aa8d8c413e6c405e9fd21f96500255746e86dec3016a92f543d3
MD5 0b52c8cc157b57bfdae66cb2d33fefa4
SHA1 00efada95317be0723acad03948731686044ef33
SHA512 46eb5d22fb3c5b9d600f9a37bc0b74da417f5b52e8a974fa8022c735a42c04d9410373a46d3dd485ade0bf31c8471a184d04a3e147a945244588599a573d4b48
MD5 SHA1 SHA512

Submit Download

d.txt

Path C:\Users\Admin\AppData\Local\Temp\TestAtomicFileSystemReturnsRecoverableHandleAfterDurablePrepareE2052517502\001\repo\d.txt
Size 9B
SHA256 a8d56d60fdd678a839e5444f6a460a4ce2f37eaa80411a1bc13991a1e5a8a0e6
MD5 e6b130014f8571a918c2fb5d034cd0c6
SHA1 e078d0e5edf7099c403318a8be65f80733c447d9
SHA512 2b288413afb33200cb4169200875f32654f61f2f15ae6567d6c340e9974b22da2b8d24bbdb907c634b6280266efb8b470e4e299c583aff919acc1f6f2ba7bb25
MD5 SHA1 SHA512

Submit Download

.gitattributes

Path C:\Users\Admin\AppData\Local\Temp\TestAtomicFileSystemRevalidatesReadDependencyAtCommit4105184238\001\repo\.gitattributes
Size 18B
SHA256 667b93be6ede617192a0c6ac9e3664b1727402239531277b6cd47b53e73a6535
MD5 b4a3cf8f29f0835a1200245eb97d32b5
SHA1 05ff99870fdf58e1fb1b9412a1220d7f4b317839
SHA512 fcb4bf1b8a43ebf41a884150cdb0f0f7672091a8e36ac96c326f8e747acace7c7204e260ed23ca363538b1eeaef81266d5f67d7047a9cb1fc759b203a9a274bf
MD5 SHA1 SHA512

Submit Download

.gitattributes

Path C:\Users\Admin\AppData\Local\Temp\TestAtomicFileSystemRevalidatesReadDependencyAtCommit4105184238\001\repo\.gitattributes
Size 20B
SHA256 f7dbdf6de7d9b6b2ca39cec372872982331eb9af71ac616332bca7f19b6cdb8a
MD5 9d082f42772ea63caa9c5ec01e1ecfd0
SHA1 96bc38c2a5ef9faed00fdcd019eb995c27cde0aa
SHA512 6e540f45b94c30364c02cd1dcfb125d4b2d8daf744a287cadc770f97859fcf7bb9b7bacea7ae2b238b4b008a9fccf427a8f1e09fa29ba13e84a59dba2e34e43b
MD5 SHA1 SHA512

Submit Download

source.txt

Path C:\Users\Admin\AppData\Local\Temp\TestCopySnapshotDetectsSourceRaceAndCleansPartialState3211910705\001\source.txt
Size 5B
SHA256 f39592393ef0859cb196a52693d2cea00fb2df784b3c04ae54aa7cadb8e562f8
MD5 632a2406bbcbcd553eec45ac14b40a0a
SHA1 405906c9d5be6ae5393ca65fb0e7c38e0d585ecb
SHA512 6dab7614c464349e1c5eba7a8c4967f670b4c693b5d5b13566e059b20b671d1b721b19a08069124dfc7bec199884a5d178670e878415975752eb19db416fb1a7
MD5 SHA1 SHA512

Submit Download

.git

Path C:\Users\Admin\AppData\Local\Temp\TestCopySnapshotExcludesAdministrativeFilesAsWellAsDirectories509868193\001\.git
Size 118B
SHA256 a3b222e86b772d99ae095d9d8718fca2567c031e22e522fb3f754b67bbb17fc4
MD5 633edd84de0c48b3df71b5c7c9b831ff
SHA1 cd1daf58ed3e8e6272dd995c28bc140b8ce3d302
SHA512 012957ffa7e17bdf8e89504b73b02c8f2d2b81626ebd405f7fc055534ab59e587186fb70bd0a984b2d14df67d78f002f632cb9948ef00ce275a375df551cdecb
TLSH
T155B09B409787BA45454550525614C1DC40770C592D062B19873DC9D49D4540B7575391
MD5 SHA1 SHA512 TLSH

Submit Download

.rails-transactions

Path C:\Users\Admin\AppData\Local\Temp\TestCopySnapshotExcludesAdministrativeFilesAsWellAsDirectories509868193\001\.rails-transactions
Size 7B
SHA256 715dc8493c36579a5b116995100f635e3572fdf8703e708ef1a08d943b36774e
MD5 2c17c6393771ee3048ae34d6b380c5ec
SHA1 e80721793c24ae14edfca9b26ad406a9815cd3ff
SHA512 9d9f1d99d6a2e8488d0c330269f0a15d1f56bd4b309c840ff678fc6a32f15e2cf6efaf76e4d5471e7af9f88a12014a7ae6f91fa2e08fc622493920a555290c93
MD5 SHA1 SHA512

Submit Download

source.txt

Path C:\Users\Admin\AppData\Local\Temp\TestCopySnapshotExcludesAdministrativeFilesAsWellAsDirectories509868193\001\source.txt
Size 6B
SHA256 41cf6794ba4200b839c53531555f0f3998df4cbb01a4d5cb0b94e3ca5e23947d
MD5 36cd38f49b9afa08222c0dc9ebfe35eb
SHA1 828d338a9b04221c9cbe286f50cd389f68de4ecf
SHA512 81c090b90e512891ed8a837c5115b058aae02ad0e07af63a96064ef0b60348a715266d024fd360dbd53cb29d3b925d0e5992925a7aed681c4b4a51a918e718a9
MD5 SHA1 SHA512

Submit Download

hardlink.go

Path C:\Users\Admin\AppData\Local\Temp\TestCopySnapshotIsExactPrivateAndDisposable1825539529\001\src\hardlink.go
Size 13B
SHA256 df1d036cbbf3df46e2045071e082245ece204c7f53ecf0a4e022bff9bb228f47
MD5 98ab3c79c3a0e5fcced00e8433fecdca
SHA1 af96a5c06ec8bf0b99b61196b464b2f70533fe93
SHA512 bb97b74eb8df8ccb6952f6198c08ee6de9dd7f57601d00733ebcacdf5925147650ab8fa81401e4dcb1198a303fee62ad137dde34f0a22ffc0e703169e095cb2f
MD5 SHA1 SHA512

Submit Download

large.txt

Path C:\Users\Admin\AppData\Local\Temp\TestCopySnapshotRejectsReparseAndQuotaOverflowquota928551679\001\large.txt
Size 5B
SHA256 5994471abb01112afcc18159f6cc74b4f511b99806da59b3caf5a9c173cacfc5
MD5 827ccb0eea8a706c4c34a16891f84e7b
SHA1 8cb2237d0679ca88db6464eac60da96345513964
SHA512 3627909a29c31381a071ec27f7c9ca97726182aed29a7ddd2e54353322cfb30abb9e3a6df2ac2c20fe23436311d678564d0c8d305930575f60e2d3d048184d79
MD5 SHA1 SHA512

Submit Download

worker.go

Path C:\Users\Admin\AppData\Local\Temp\TestHandlePathGuardBindsResolvesAndRevalidates1261810395\001\src\worker.go
Size 12B
SHA256 ec016cc15d1b6ac2ddd18a8986d7cec46fced460244c9daa761ddfd5b9a10907
MD5 c28da4fc30de1d2d4e8179b19ee9a734
SHA1 46b7dd2533fa606e97c9fa9c716790c2a69b0195
SHA512 b16dda042c4c37f1f4f53a913e4e0a628929aebfac34c0a8fb23b39402ede7cb5bb3c62aa04663cf463cd995ce51f111d907b9f3aa6989fc32e297c86e3b01c5
MD5 SHA1 SHA512

Submit Download

target.txt

Path C:\Users\Admin\AppData\Local\Temp\TestHandlePathGuardDetectsReplacementAndCreateRace2677324560\001\target.txt
Size 6B
SHA256 6db7d803e74f1ffa7d8f5adc0bf95b3e15bf4c8373fffadf546227cc6c6742cb
MD5 2f44417567bc123bd7c60de8c2a2b444
SHA1 51de2b835bd35a67eb32dbcd3d77d4b96e5aa39d
SHA512 b2af2dd6c5157a17610ccb9e0b093fb040e411a98da63fb3caa0e1bfb95e9a401283319d20cdffe147f8296ddf235da62da8ea343f82339e00014b63e15dcd1a
MD5 SHA1 SHA512

Submit Download

CaseName.txt

Path C:\Users\Admin\AppData\Local\Temp\TestHandlePathGuardRejectsCaseAliasAndHardlink1310244980\001\CaseName.txt
Size 5B
SHA256 cd42404d52ad55ccfa9aca4adc828aa5800ad9d385a0671fbcbf724118320619
MD5 2063c1608d6e0baf80249c42e2be5804
SHA1 f32b67c7e26342af42efabc674d441dca0a281c5
SHA512 ec2c83edecb60304d154ebdb85bdfaf61a92bd142e71c4f7b25a15b9cb5f3c0ae301cfb3569cf240e4470031385348bc296d8d99d09e06b26f09591a97527296
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads