d3764b40df4bb1d0cfd0e007b16248fa8b8e397c352d39f5f9bee3406616ea38

General

Target
2026-08-02_8f1035de499a53a9e4a34b8624d73d5a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 5.9MB
Sample260802-dc6yta11cw
SHA256 d3764b40df4bb1d0cfd0e007b16248fa8b8e397c352d39f5f9bee3406616ea38
MD5 8f1035de499a53a9e4a34b8624d73d5a
SHA1 9624f182782d14b13c61e52ce21b9fd16b2c22bd
SHA512 376af19527a4b371f4b5bdb9ecdebe2f20b4dbd84dfe033a5407aaa8f1fe070e4ea3daab26d42cc1f593deef0a5fc05f2575bb655503f57fea318e63d74adc55
SSDEEP 49152:QiII/oqGi7PO8MrWiUguX1qikZW0i4ZvMnrwgnrt2jQjtMEsj0TKQK1K6IK5QPpN:QipnNmgxrDww5HE
TLSH
T13D564947FC5524E9C1AE92318A769123BB317C491B2123D72B50F2396FB7BE0ADB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution spyware stealer

Malware Config

Signatures

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c581-1.dat	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Executes dropped EXE 1 IoCs

pid	Process
6048	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4320	cmd.exe
1260	cmd.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1292	cmd.exe
4376	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 1292	2908	2026-08-02_8f1035de499a53a9e4a34b8624d73d5a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	90
PID 1292 wrote to memory of 3884	1292	cmd.exe	92
PID 2908 wrote to memory of 4320	2908	2026-08-02_8f1035de499a53a9e4a34b8624d73d5a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 4320 wrote to memory of 3348	4320	cmd.exe	93
PID 6048 wrote to memory of 4376	6048	svchost.exe	96
PID 6048 wrote to memory of 1260	6048	svchost.exe	97
PID 4376 wrote to memory of 3296	4376	cmd.exe	98
PID 1260 wrote to memory of 568	1260	cmd.exe	99

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3348	attrib.exe
568	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_8f1035de499a53a9e4a34b8624d73d5a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_8f1035de499a53a9e4a34b8624d73d5a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\system32\cmd.exe
  cmd /c "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"SystemUpdate\" /t REG_SZ /d \"C:\Users\Admin\AppData\Roaming\SystemUpdate\svchost.exe\" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\system32\reg.exe
    reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"SystemUpdate\" /t REG_SZ /d \"C:\Users\Admin\AppData\Roaming\SystemUpdate\svchost.exe\" /f
    3⤵
    PID:3884
- C:\Windows\system32\cmd.exe
  cmd /c "attrib +h +s \"C:\Users\Admin\AppData\Roaming\SystemUpdate\svchost.exe\""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\system32\attrib.exe
    attrib +h +s \"C:\Users\Admin\AppData\Roaming\SystemUpdate\svchost.exe\"
    3⤵
    - Views/modifies file attributes
    PID:3348

C:\Users\Admin\AppData\Roaming\SystemUpdate\svchost.exe
"C:\Users\Admin\AppData\Roaming\SystemUpdate\svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048
- C:\Windows\system32\cmd.exe
  cmd /c "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"SystemUpdate\" /t REG_SZ /d \"C:\Users\Admin\AppData\Roaming\SystemUpdate\svchost.exe\" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\system32\reg.exe
    reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" /v \"SystemUpdate\" /t REG_SZ /d \"C:\Users\Admin\AppData\Roaming\SystemUpdate\svchost.exe\" /f
    3⤵
    PID:3296
- C:\Windows\system32\cmd.exe
  cmd /c "attrib +h +s \"C:\Users\Admin\AppData\Roaming\SystemUpdate\svchost.exe\""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Windows\system32\attrib.exe
    attrib +h +s \"C:\Users\Admin\AppData\Roaming\SystemUpdate\svchost.exe\"
    3⤵
    - Views/modifies file attributes
    PID:568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Roaming\SystemUpdate\svchost.exe
Size 5.9MB
SHA256 d3764b40df4bb1d0cfd0e007b16248fa8b8e397c352d39f5f9bee3406616ea38
MD5 8f1035de499a53a9e4a34b8624d73d5a
SHA1 9624f182782d14b13c61e52ce21b9fd16b2c22bd
SHA512 376af19527a4b371f4b5bdb9ecdebe2f20b4dbd84dfe033a5407aaa8f1fe070e4ea3daab26d42cc1f593deef0a5fc05f2575bb655503f57fea318e63d74adc55
SSDEEP 49152:QiII/oqGi7PO8MrWiUguX1qikZW0i4ZvMnrwgnrt2jQjtMEsj0TKQK1K6IK5QPpN:QipnNmgxrDww5HE
TLSH
T13D564947FC5524E9C1AE92318A769123BB317C491B2123D72B50F2396FB7BE0ADB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads