86b7cb3d66446b0311d95a06a8be728531ba4235a9e4e7a264c728c690e3b580

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 01:13

Target
2026-07-31_dd7d007e901ba43b183b8e43d5a5380e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 14.5MB
Sample260801-blk2labd44
SHA256 86b7cb3d66446b0311d95a06a8be728531ba4235a9e4e7a264c728c690e3b580
MD5 dd7d007e901ba43b183b8e43d5a5380e
SHA1 124b45b9b84315b9c3dca856b570c07d60c10fa7
SHA512 1931df38e22dda4ead5af6fed33fabb0eba2aba0e3fa5f0d235fea9b6abac65c304068c9eab421d32f192edfd12a47b998b78a5f7171a45820bbdd4ef7439389
SSDEEP 98304:aucXERKP0g3E9Onj6n00hWWl/+4V1ZixKE/:avEU0BhW+/LUX
TLSH
T132E64A43E97561E5E0AEA135CA7695137BB13C894B3063C35B90F7242F37BD0AAB9708
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs

resource	yara_rule
behavioral1/memory/2316-0-0x00007FF777730000-0x00007FF77A250000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/2316-1-0x00007FF777730000-0x00007FF77A250000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs

resource	yara_rule
behavioral1/memory/2316-0-0x00007FF777730000-0x00007FF77A250000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/2316-1-0x00007FF777730000-0x00007FF77A250000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/memory/2316-0-0x00007FF777730000-0x00007FF77A250000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2316-0-0x00007FF777730000-0x00007FF77A250000-memory.dmp	upx
behavioral1/memory/2316-1-0x00007FF777730000-0x00007FF77A250000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\2026-07-31_dd7d007e901ba43b183b8e43d5a5380e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_dd7d007e901ba43b183b8e43d5a5380e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
PID:2316

memory/2316-0-0x00007FF777730000-0x00007FF77A250000-memory.dmp

Download

memory/2316-1-0x00007FF777730000-0x00007FF77A250000-memory.dmp

Download