Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 23:41
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 31.8MB
- Sample260802-3pd61ayxew
- SHA256 b2b9eaf05e19094bf8162445d8b3e4e099fcfcc58d514b40b082e626c51eaefe
- MD5 c903c6bd4c5752c29b826eb9afd45360
- SHA1 c08c08cc679c0ce7969473ed1973dd61db7b33a6
- SHA512 fe0efbad58d34bd5c41cb8c02cb7cda5a6f63e4c410dc9e837c9495e969c973e47fc78d0141844dec1ac5608a2a8971346c96ea5dce023125740cc2fb4f03542
- SSDEEP 196608:2lubcAPvUB6C1hd62oMNSOkRw5inNi2yy1YiuNELiHcsg+nRTbs:2wo8c3XSOkRwqNNyy1Yiu2Qcs5RM
- TLSH T198774907F86508E9C0ADD134897295137BB17C568B3137EB1B60F6246F7ABD0AEBA350
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 19 223.5.5.5 4420 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Destination IP 20 223.6.6.6 4420 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Destination IP 7 223.5.5.5 4420 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Destination IP 8 223.6.6.6 4420 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Destination IP 10 223.5.5.5 4420 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Destination IP 11 223.6.6.6 4420 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 14 Go-http-client/1.1 - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 6b00000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e0f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1900000001000000100000001f7e750b566b128ac0b8d6576d2a70a52000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 5c0000000100000004000000000800001900000001000000100000001f7e750b566b128ac0b8d6576d2a70a503000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1d0000000100000010000000e3f9af952c6df2aaa41706a77a44c2031400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f76200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e0b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b002000430041000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df16b00000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e2000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 4420 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 4420 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 4420 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 4420 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 4420 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4420 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4420 wrote to memory of 3656 4420 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 91 PID 4420 wrote to memory of 6224 4420 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 92 PID 4420 wrote to memory of 2064 4420 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 93 PID 4420 wrote to memory of 6524 4420 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 94 PID 4420 wrote to memory of 6640 4420 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 95 PID 4420 wrote to memory of 6396 4420 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 96 PID 4420 wrote to memory of 4452 4420 2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_c903c6bd4c5752c29b826eb9afd45360_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Unexpected DNS network traffic destination
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\system32\netsh.exenetsh winsock reset2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3656
-
-
C:\Windows\system32\netsh.exenetsh interface ipv4 delete arpcache2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:6224
-
-
C:\Windows\system32\netsh.exenetsh winsock reset2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2064
-
-
C:\Windows\system32\netsh.exenetsh interface ipv4 delete arpcache2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:6524
-
-
C:\Windows\system32\netsh.exenetsh winsock reset2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:6640
-
-
C:\Windows\system32\netsh.exenetsh interface ipv4 delete arpcache2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:6396
-
-
C:\Windows\system32\netsh.exenetsh interface ipv4 set subinterface NodeBabyLink mtu=14302⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4452
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\local.ionewu.com.key
- Size 1KB
- SHA256 0a162b2c66d5a239f67710a3931cf199f840b17bc3aaf518743f05221a1aca7c
- MD5 5b329ab5497f041c58160cb615715b53
- SHA1 ce636ad91d078ecf881f75d47396f52cdb26e76e
- SHA512 54f814c80362a639b84e20f733d5628867fc6995e5675f8b4b44a71d79c971f94d21d3f5839217441cbfbfb0a06e08f144bf386bd3c29d573edb85ef54a8315b
- TLSH T17331F8B45C93552D25EFE1C42C83ABC4C1A4D9367BED7DD40E50597558D2821EA3D822
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\local.ionewu.com.pem
- Size 5KB
- SHA256 109f7b93b6c6943cdc0f31ebe662bf17ecf3ebe38e535926411a6e40e9e78546
- MD5 e1a19603992cecd101679a9204b4a580
- SHA1 fc3170366bc0d36992cf2203f61518931bfbfe78
- SHA512 c51ca0188a17696995421268c3b2f52473d822771190848b26ea83313d54a8198070aefa7316efd6ce7c07932d5db2fc718ce2a3d69770da1188da6c65b5c3da
- SSDEEP 96:Lrca328PTmWmymEbEBmaCcNASwDgYnse2kOOh1aBRYWi5TcoqTZ3X0X3tv:Hca3fi0DE4aCcLogGsBkOI1+YJ5TcVT+
- TLSH T188B15B6F7FD02B4C69B7F49DC6DD476A583CF32651D762A009683B04CA1602CEEDC88A
- MD5 SHA1 SHA512 SSDEEP TLSH