796a8eca7d20337b9cb0abadf93ca6c67b163db70ea3a68e8ad9bea1177f1b27

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 05:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_2c4c1b75f28b256e744104590e8195c7_coinminer_glassworm_snatch.exe
Size 4.4MB
Sample260730-gj3rhsdn2w
SHA256 796a8eca7d20337b9cb0abadf93ca6c67b163db70ea3a68e8ad9bea1177f1b27
MD5 2c4c1b75f28b256e744104590e8195c7
SHA1 33b99657185b0d1f1045c3fbca79db7fc28572fe
SHA512 5e524f55e7b98c6250fa85cfe7b5e3f6c0265096268c4231329133deb761987a4928a4a5715e24fa74e7fda3d8b81aa9d1f4eb7585db9179cfe441f7f6661008
SSDEEP 49152:oyGpZeWfl6Ko7XE4iKhyUBRSHL9E7OhIBTiSVLPwC69xVRoaseeI4kmeb:oyexN6/yib2Su9uXk
TLSH
T1A0263817FCA658E9C0AED2358A7296127B607C881F3163E71E70B6342F76BD09DB9314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 35	3384	2026-07-30_2c4c1b75f28b256e744104590e8195c7_coinminer_glassworm_snatch.exe
Token: 35	3384	2026-07-30_2c4c1b75f28b256e744104590e8195c7_coinminer_glassworm_snatch.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 2448	3384	2026-07-30_2c4c1b75f28b256e744104590e8195c7_coinminer_glassworm_snatch.exe	90
PID 3384 wrote to memory of 928	3384	2026-07-30_2c4c1b75f28b256e744104590e8195c7_coinminer_glassworm_snatch.exe	92
PID 3384 wrote to memory of 4336	3384	2026-07-30_2c4c1b75f28b256e744104590e8195c7_coinminer_glassworm_snatch.exe	94
PID 928 wrote to memory of 4616	928	2026-07-30_2c4c1b75f28b256e744104590e8195c7_coinminer_glassworm_snatch.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-30_2c4c1b75f28b256e744104590e8195c7_coinminer_glassworm_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_2c4c1b75f28b256e744104590e8195c7_coinminer_glassworm_snatch.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Users\Admin\AppData\Local\Temp\2026-07-30_2c4c1b75f28b256e744104590e8195c7_coinminer_glassworm_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-30_2c4c1b75f28b256e744104590e8195c7_coinminer_glassworm_snatch.exe -test.run=^TestJobProcessHelper$ -- output
  2⤵
  PID:2448
- C:\Users\Admin\AppData\Local\Temp\2026-07-30_2c4c1b75f28b256e744104590e8195c7_coinminer_glassworm_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-30_2c4c1b75f28b256e744104590e8195c7_coinminer_glassworm_snatch.exe -test.run=^TestJobProcessHelper$ -- spawn
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Users\Admin\AppData\Local\Temp\2026-07-30_2c4c1b75f28b256e744104590e8195c7_coinminer_glassworm_snatch.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-30_2c4c1b75f28b256e744104590e8195c7_coinminer_glassworm_snatch.exe -test.run=^TestJobProcessHelper$ -- sleep
    3⤵
    PID:4616
- C:\Users\Admin\AppData\Local\Temp\2026-07-30_2c4c1b75f28b256e744104590e8195c7_coinminer_glassworm_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-30_2c4c1b75f28b256e744104590e8195c7_coinminer_glassworm_snatch.exe -test.run=^TestJobProcessHelper$ -- io
  2⤵
  PID:4336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

stage-000002.bin

Path C:\Users\Admin\AppData\Local\Temp\TestAtomicFileSystemCommitsAndFinalizesMultiFileTransaction3572021060\001\.rails-transactions-a571fe7c5c50d5b1\txn.basic\stage-000002.bin
Size 9B
SHA256 91fda4d39078f08f4840183f5f532cd072159ba3d09f7d93d59f5830fa43cee9
MD5 5ca71ca7e6ba97e06414d0bdfc6ac03b
SHA1 c81f12383341466e4c923eabfb900e768b58d9ab
SHA512 42cd1184240e444169ce013e461ac9fe2140f01152c8f4f9f712dc7daa0534ca953bafb156a6e62ad947bfb234427645e587f12c452fee39cc789ce7bdeafbb8
MD5 SHA1 SHA512

Submit Download

stage-000003.bin

Path C:\Users\Admin\AppData\Local\Temp\TestAtomicFileSystemCommitsAndFinalizesMultiFileTransaction3572021060\001\.rails-transactions-a571fe7c5c50d5b1\txn.basic\stage-000003.bin
Size 23B
SHA256 42e4ba283f5d80ce90a8030f21b5b6bd9ff4604ef1848a4b7b668c6a68171a50
MD5 850c8d74b12d19f3da2b969654a81c0c
SHA1 8865da13b8b5a7cfd929b324b2b82acfdb0b0ebe
SHA512 93cf233800ca3322ffedeb58e4afdbff9b116e522798aa61a2959884e857f84b09761b585def44e89677cf61ffdfd4f13ad48c97e9357ac6a5e06899882532f2
MD5 SHA1 SHA512

Submit Download

a.txt

Path C:\Users\Admin\AppData\Local\Temp\TestAtomicFileSystemDoesNotOverwriteEditorRace4144800985\001\repo\a.txt
Size 7B
SHA256 001941a763e192f660176a654132e05352a4dd7a276052e5f31821813425ae8f
MD5 0d44778d72ea6d6a2973b94567b56482
SHA1 584c090f67c3e26d818401a1d31d63e77e4772ed
SHA512 2565bd0961e47339a1085e2f0208423709adb4acc57dc0822b555e79b14aca4b3397e950d69a82b6e660e2f73d7381d0aa57dde53b0f41bfc8fdb0a2e3561456
MD5 SHA1 SHA512

Submit Download

stage-000000.bin

Path C:\Users\Admin\AppData\Local\Temp\TestAtomicFileSystemReturnsRecoverableHandleAfterDurablePrepareE2557286227\001\.rails-transactions-37fc3ac9d4381186\txn.disk-full\stage-000000.bin
Size 8B
SHA256 0732c97eef85880f7cf628e0b7ade6151515ddb78793dbb88c9ee2ff18bb4af9
MD5 ff8fe59c43b95284c50c517e8ab558af
SHA1 b619301304b49bd4ae112572bfbe9b3547ae000b
SHA512 fddcaf7b66aed9ad0849070b1648415b742839b30f0789346431590baf23eff479330a094d06c1da45ddc9dd858fd01a86956baa00ef8220f56c383e9353aea5
MD5 SHA1 SHA512

Submit Download

b.txt

Path C:\Users\Admin\AppData\Local\Temp\TestAtomicFileSystemReturnsRecoverableHandleAfterDurablePrepareE2557286227\001\repo\b.txt
Size 9B
SHA256 5fddadbcfe06aa8d8c413e6c405e9fd21f96500255746e86dec3016a92f543d3
MD5 0b52c8cc157b57bfdae66cb2d33fefa4
SHA1 00efada95317be0723acad03948731686044ef33
SHA512 46eb5d22fb3c5b9d600f9a37bc0b74da417f5b52e8a974fa8022c735a42c04d9410373a46d3dd485ade0bf31c8471a184d04a3e147a945244588599a573d4b48
MD5 SHA1 SHA512

Submit Download

d.txt

Path C:\Users\Admin\AppData\Local\Temp\TestAtomicFileSystemReturnsRecoverableHandleAfterDurablePrepareE2557286227\001\repo\d.txt
Size 9B
SHA256 a8d56d60fdd678a839e5444f6a460a4ce2f37eaa80411a1bc13991a1e5a8a0e6
MD5 e6b130014f8571a918c2fb5d034cd0c6
SHA1 e078d0e5edf7099c403318a8be65f80733c447d9
SHA512 2b288413afb33200cb4169200875f32654f61f2f15ae6567d6c340e9974b22da2b8d24bbdb907c634b6280266efb8b470e4e299c583aff919acc1f6f2ba7bb25
MD5 SHA1 SHA512

Submit Download

.gitattributes

Path C:\Users\Admin\AppData\Local\Temp\TestAtomicFileSystemRevalidatesReadDependencyAtCommit2849277017\001\repo\.gitattributes
Size 18B
SHA256 667b93be6ede617192a0c6ac9e3664b1727402239531277b6cd47b53e73a6535
MD5 b4a3cf8f29f0835a1200245eb97d32b5
SHA1 05ff99870fdf58e1fb1b9412a1220d7f4b317839
SHA512 fcb4bf1b8a43ebf41a884150cdb0f0f7672091a8e36ac96c326f8e747acace7c7204e260ed23ca363538b1eeaef81266d5f67d7047a9cb1fc759b203a9a274bf
MD5 SHA1 SHA512

Submit Download

.gitattributes

Path C:\Users\Admin\AppData\Local\Temp\TestAtomicFileSystemRevalidatesReadDependencyAtCommit2849277017\001\repo\.gitattributes
Size 20B
SHA256 f7dbdf6de7d9b6b2ca39cec372872982331eb9af71ac616332bca7f19b6cdb8a
MD5 9d082f42772ea63caa9c5ec01e1ecfd0
SHA1 96bc38c2a5ef9faed00fdcd019eb995c27cde0aa
SHA512 6e540f45b94c30364c02cd1dcfb125d4b2d8daf744a287cadc770f97859fcf7bb9b7bacea7ae2b238b4b008a9fccf427a8f1e09fa29ba13e84a59dba2e34e43b
MD5 SHA1 SHA512

Submit Download

a.txt

Path C:\Users\Admin\AppData\Local\Temp\TestAtomicFileSystemRollsBackNativeSharingViolation3507280710\001\repo\a.txt
Size 9B
SHA256 021aad3bada42202b77dbee3563071ee6bed8a7183c9b2691854583e2d6bdbde
MD5 0931a9532622610f81bc1c9c4ded3784
SHA1 1e7cf59df3bb1f320777521ec6025b2944457108
SHA512 54e7569405c0c93059603797df7efd3461fce91c2bbb1f004a991bb1da454dda31d914b53a8fba3046c55a4ebfd4255066f60ab7ad576e81c54985be84e4321d
MD5 SHA1 SHA512

Submit Download

source.txt

Path C:\Users\Admin\AppData\Local\Temp\TestCopySnapshotDetectsSourceRaceAndCleansPartialState173448237\001\source.txt
Size 6B
SHA256 6db7d803e74f1ffa7d8f5adc0bf95b3e15bf4c8373fffadf546227cc6c6742cb
MD5 2f44417567bc123bd7c60de8c2a2b444
SHA1 51de2b835bd35a67eb32dbcd3d77d4b96e5aa39d
SHA512 b2af2dd6c5157a17610ccb9e0b093fb040e411a98da63fb3caa0e1bfb95e9a401283319d20cdffe147f8296ddf235da62da8ea343f82339e00014b63e15dcd1a
MD5 SHA1 SHA512

Submit Download

source.txt

Path C:\Users\Admin\AppData\Local\Temp\TestCopySnapshotDetectsSourceRaceAndCleansPartialState173448237\001\source.txt
Size 5B
SHA256 f39592393ef0859cb196a52693d2cea00fb2df784b3c04ae54aa7cadb8e562f8
MD5 632a2406bbcbcd553eec45ac14b40a0a
SHA1 405906c9d5be6ae5393ca65fb0e7c38e0d585ecb
SHA512 6dab7614c464349e1c5eba7a8c4967f670b4c693b5d5b13566e059b20b671d1b721b19a08069124dfc7bec199884a5d178670e878415975752eb19db416fb1a7
MD5 SHA1 SHA512

Submit Download

.git

Path C:\Users\Admin\AppData\Local\Temp\TestCopySnapshotExcludesAdministrativeFilesAsWellAsDirectories260293622\001\.git
Size 118B
SHA256 ff11f89421c07fb8861937ecdb466c7d4a195224606cbecb5b39407dd3b00140
MD5 878748294f0817f2414d7e8888caef2d
SHA1 33a3ee102120a409b9f4de08d825f18ce4bc5e70
SHA512 66f23990cf018542c18779e87fa47cfdcf63aa8e808986e3358583908775d8024d1136557b6593b4a587cbf65332f9409b70acef1c294c11ca4bc71df7871310
TLSH
T196B09B40D7867A55118450975614C28840770C592D0537198B2DCD949D4140B7557391
MD5 SHA1 SHA512 TLSH

Submit Download

.rails-transactions

Path C:\Users\Admin\AppData\Local\Temp\TestCopySnapshotExcludesAdministrativeFilesAsWellAsDirectories260293622\001\.rails-transactions
Size 7B
SHA256 715dc8493c36579a5b116995100f635e3572fdf8703e708ef1a08d943b36774e
MD5 2c17c6393771ee3048ae34d6b380c5ec
SHA1 e80721793c24ae14edfca9b26ad406a9815cd3ff
SHA512 9d9f1d99d6a2e8488d0c330269f0a15d1f56bd4b309c840ff678fc6a32f15e2cf6efaf76e4d5471e7af9f88a12014a7ae6f91fa2e08fc622493920a555290c93
MD5 SHA1 SHA512

Submit Download

source.txt

Path C:\Users\Admin\AppData\Local\Temp\TestCopySnapshotExcludesAdministrativeFilesAsWellAsDirectories260293622\001\source.txt
Size 6B
SHA256 41cf6794ba4200b839c53531555f0f3998df4cbb01a4d5cb0b94e3ca5e23947d
MD5 36cd38f49b9afa08222c0dc9ebfe35eb
SHA1 828d338a9b04221c9cbe286f50cd389f68de4ecf
SHA512 81c090b90e512891ed8a837c5115b058aae02ad0e07af63a96064ef0b60348a715266d024fd360dbd53cb29d3b925d0e5992925a7aed681c4b4a51a918e718a9
MD5 SHA1 SHA512

Submit Download

hardlink.go

Path C:\Users\Admin\AppData\Local\Temp\TestCopySnapshotIsExactPrivateAndDisposable1777896570\001\src\hardlink.go
Size 13B
SHA256 df1d036cbbf3df46e2045071e082245ece204c7f53ecf0a4e022bff9bb228f47
MD5 98ab3c79c3a0e5fcced00e8433fecdca
SHA1 af96a5c06ec8bf0b99b61196b464b2f70533fe93
SHA512 bb97b74eb8df8ccb6952f6198c08ee6de9dd7f57601d00733ebcacdf5925147650ab8fa81401e4dcb1198a303fee62ad137dde34f0a22ffc0e703169e095cb2f
MD5 SHA1 SHA512

Submit Download

hardlink.go

Path C:\Users\Admin\AppData\Local\Temp\TestCopySnapshotIsExactPrivateAndDisposable1777896570\001\src\hardlink.go
Size 16B
SHA256 fbe06aa700c70a568bef3585095a668af24c85c11553f83818009eba13070f60
MD5 9ed97d60077e62108c83c213b64fc4ea
SHA1 227f96bdf1606e4231ab055f914dd4624d2a7499
SHA512 de2aada6b8ebd1b73bd2e2c253e7db4e5ccd88b8c9181e36bb0820a7852a3adc37f38867ba071bdf388392a811b6fecb9953c657898e2a70adb6d152dc44f850
MD5 SHA1 SHA512

Submit Download

large.txt

Path C:\Users\Admin\AppData\Local\Temp\TestCopySnapshotRejectsReparseAndQuotaOverflowquota3429930495\001\large.txt
Size 5B
SHA256 5994471abb01112afcc18159f6cc74b4f511b99806da59b3caf5a9c173cacfc5
MD5 827ccb0eea8a706c4c34a16891f84e7b
SHA1 8cb2237d0679ca88db6464eac60da96345513964
SHA512 3627909a29c31381a071ec27f7c9ca97726182aed29a7ddd2e54353322cfb30abb9e3a6df2ac2c20fe23436311d678564d0c8d305930575f60e2d3d048184d79
MD5 SHA1 SHA512

Submit Download

worker.go

Path C:\Users\Admin\AppData\Local\Temp\TestHandlePathGuardBindsResolvesAndRevalidates4227402474\001\src\worker.go
Size 12B
SHA256 ec016cc15d1b6ac2ddd18a8986d7cec46fced460244c9daa761ddfd5b9a10907
MD5 c28da4fc30de1d2d4e8179b19ee9a734
SHA1 46b7dd2533fa606e97c9fa9c716790c2a69b0195
SHA512 b16dda042c4c37f1f4f53a913e4e0a628929aebfac34c0a8fb23b39402ede7cb5bb3c62aa04663cf463cd995ce51f111d907b9f3aa6989fc32e297c86e3b01c5
MD5 SHA1 SHA512

Submit Download

CaseName.txt

Path C:\Users\Admin\AppData\Local\Temp\TestHandlePathGuardRejectsCaseAliasAndHardlink1497643750\001\CaseName.txt
Size 5B
SHA256 cd42404d52ad55ccfa9aca4adc828aa5800ad9d385a0671fbcbf724118320619
MD5 2063c1608d6e0baf80249c42e2be5804
SHA1 f32b67c7e26342af42efabc674d441dca0a281c5
SHA512 ec2c83edecb60304d154ebdb85bdfaf61a92bd142e71c4f7b25a15b9cb5f3c0ae301cfb3569cf240e4470031385348bc296d8d99d09e06b26f09591a97527296
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads