Overview

overview

7

Static

static

3

2026-08-01...ch.exe

windows10-2004-x64

7

2026-08-01...ch.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 00:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_60d347bc48184c2f4b01282ee98e63b5_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 11.5MB
  • Sample260802-ayevnszzbz
  • SHA256 1072c9907d8b3dfea290db2c8270a32e4f56c1b051b708ece7bf78cef53a2547
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Executes a command shell one-liner 1 TTPs 5 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_60d347bc48184c2f4b01282ee98e63b5_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_60d347bc48184c2f4b01282ee98e63b5_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
    • Creates a file in the Startup directory
    • Suspicious use of WriteProcessMemory
    PID:204
    • C:\Windows\system32\cmd.exe
      cmd /c taskkill /f /im cloudflared.exe
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:236
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im cloudflared.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1484
    • C:\Windows\system32\cmd.exe
      cmd /c attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker.exe
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:2428
      • C:\Windows\system32\attrib.exe
        attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker.exe
        3⤵
        • Views/modifies file attributes
        PID:2528
    • C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsService /t REG_SZ /d \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker.exe\" /f
      2⤵
      • Adds Run key to start application
      • Modifies registry key
      PID:1848
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4536
      • C:\Windows\system32\cmd.exe
        cmd /c taskkill /f /im cloudflared.exe
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4568
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im cloudflared.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4584
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker.exe --watchdog 4536
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1528
        • C:\Windows\system32\cmd.exe
          cmd /c taskkill /f /im cloudflared.exe
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3776
          • C:\Windows\system32\taskkill.exe
            taskkill /f /im cloudflared.exe
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4484
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:5172
    • C:\Windows\system32\cmd.exe
      cmd /c taskkill /f /im cloudflared.exe
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5904
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im cloudflared.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3700
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker.exe --watchdog 5172
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5636
      • C:\Windows\system32\cmd.exe
        cmd /c taskkill /f /im cloudflared.exe
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5800
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im cloudflared.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4628

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        RuntimeBroker.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker.exe
        • Size 11.5MB
        • SHA256 1072c9907d8b3dfea290db2c8270a32e4f56c1b051b708ece7bf78cef53a2547
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download