Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/07/2026, 23:14
General
- Target 2026-07-31_c8084870a4ee0e7bcd39deec45f37ca0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 5.8MB
- Sample260731-28aggsac28
- SHA256 766c268ed0a6c4644720a4f6869e697e1cebaf36ffd2ed8ab99930514700656f
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 3 IoCs
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_c8084870a4ee0e7bcd39deec45f37ca0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_c8084870a4ee0e7bcd39deec45f37ca0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\WER' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WerFault.exe.lnk'); $Shortcut.TargetPath = 'C:\ProgramData\Microsoft\Windows\WER\WerFault.exe'; $Shortcut.WorkingDirectory = 'C:\ProgramData\Microsoft\Windows\WER'; $Shortcut.Description = 'Windows Error Reporting Service'; $Shortcut.Save();"2⤵
- Command and Scripting Interpreter: PowerShell
- Creates a file in the Startup directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\Microsoft\Windows\WER\WerFault.exe"C:\ProgramData\Microsoft\Windows\WER\WerFault.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\PROGRA~3\MICROS~1\Windows\WER\WerFault.exeC:\PROGRA~3\MICROS~1\Windows\WER\WerFault.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\WER' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WerFault.exe.lnk'); $Shortcut.TargetPath = 'C:\ProgramData\Microsoft\Windows\WER\WerFault.exe'; $Shortcut.WorkingDirectory = 'C:\ProgramData\Microsoft\Windows\WER'; $Shortcut.Description = 'Windows Error Reporting Service'; $Shortcut.Save();"2⤵
- Command and Scripting Interpreter: PowerShell
- Creates a file in the Startup directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\Microsoft\Windows\WER\WerFault.exe"C:\ProgramData\Microsoft\Windows\WER\WerFault.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WerFault.exe
werdata.db
werdata.db
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ddrmuddx.jec.ps1
WerFault.exe.lnk
memory/704-11-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/704-0-0x00007FFC6A3EF000-0x00007FFC6A3F0000-memory.dmp
memory/704-12-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/704-16-0x00000198C8E10000-0x00000198C8EC2000-memory.dmp
memory/704-15-0x00000198C8BE0000-0x00000198C8BFE000-memory.dmp
memory/704-17-0x00000198C8BC0000-0x00000198C8BCA000-memory.dmp
memory/704-18-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/704-20-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/704-19-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/704-21-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/704-23-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/704-10-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/704-9-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/704-8-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/704-3-0x00000198B0A20000-0x00000198B0A42000-memory.dmp
memory/704-1-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/704-5-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/704-2-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/704-4-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp
memory/1988-43-0x0000026E64210000-0x0000026E683A8000-memory.dmp
memory/1988-34-0x0000026E5ED80000-0x0000026E5F9E9000-memory.dmp
memory/2808-55-0x00000246EB170000-0x00000246EBDD9000-memory.dmp
memory/2808-54-0x00000246F04D0000-0x00000246F4668000-memory.dmp
memory/5780-41-0x0000029DCB9D0000-0x0000029DCBA82000-memory.dmp