c3e202666ab5ce70778f8393ccfecc1c69e6b40a7cdf262dd89d46964d0e67bc

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_f92369e9397337af0ae45b448e3251cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 5.8MB
Sample260803-cf3vwswdpg
SHA256 c3e202666ab5ce70778f8393ccfecc1c69e6b40a7cdf262dd89d46964d0e67bc
MD5 f92369e9397337af0ae45b448e3251cf
SHA1 6ebf2c5b0e286afcbe38956fd776fbed9a70885c
SHA512 9f808a6260eb2cc90c1180cae348805f5b1b7fc51d7e49237a08036b0bb81d3ca2e612fae100721fa55747ce42994a72cf54aa10329eaf64e076cc08a5fd6d63
SSDEEP 49152:IAo8N1CiDn/p0H/3HW/+zrJJnu+n7se14lzkZ51CXbmj5C5e26KQK1K6zfU5Em:IAJwou3J4S5X0qEm
TLSH
T1E1565B0BFC9954E5C0AE91348A729253BB717C485B2163D72B50F2283F73BD1AEBA354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
624	powershell.exe
3444	powershell.exe
5260	powershell.exe
4860	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WerFault.exe.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WerFault.exe.lnk	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
5192	WerFault.exe
5684	WerFault.exe
4788	WerFault.exe
4828	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
264	schtasks.exe
4504	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
624	powershell.exe
624	powershell.exe
624	powershell.exe
4860	powershell.exe
4860	powershell.exe
3444	powershell.exe
3444	powershell.exe
3444	powershell.exe
5260	powershell.exe
5260	powershell.exe
5260	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	624	powershell.exe
Token: SeIncreaseQuotaPrivilege	624	powershell.exe
Token: SeSecurityPrivilege	624	powershell.exe
Token: SeTakeOwnershipPrivilege	624	powershell.exe
Token: SeLoadDriverPrivilege	624	powershell.exe
Token: SeSystemProfilePrivilege	624	powershell.exe
Token: SeSystemtimePrivilege	624	powershell.exe
Token: SeProfSingleProcessPrivilege	624	powershell.exe
Token: SeIncBasePriorityPrivilege	624	powershell.exe
Token: SeCreatePagefilePrivilege	624	powershell.exe
Token: SeBackupPrivilege	624	powershell.exe
Token: SeRestorePrivilege	624	powershell.exe
Token: SeShutdownPrivilege	624	powershell.exe
Token: SeDebugPrivilege	624	powershell.exe
Token: SeSystemEnvironmentPrivilege	624	powershell.exe
Token: SeRemoteShutdownPrivilege	624	powershell.exe
Token: SeUndockPrivilege	624	powershell.exe
Token: SeManageVolumePrivilege	624	powershell.exe
Token: 33	624	powershell.exe
Token: 34	624	powershell.exe
Token: 35	624	powershell.exe
Token: 36	624	powershell.exe
Token: SeDebugPrivilege	4860	powershell.exe
Token: SeDebugPrivilege	3444	powershell.exe
Token: SeIncreaseQuotaPrivilege	3444	powershell.exe
Token: SeSecurityPrivilege	3444	powershell.exe
Token: SeTakeOwnershipPrivilege	3444	powershell.exe
Token: SeLoadDriverPrivilege	3444	powershell.exe
Token: SeSystemProfilePrivilege	3444	powershell.exe
Token: SeSystemtimePrivilege	3444	powershell.exe
Token: SeProfSingleProcessPrivilege	3444	powershell.exe
Token: SeIncBasePriorityPrivilege	3444	powershell.exe
Token: SeCreatePagefilePrivilege	3444	powershell.exe
Token: SeBackupPrivilege	3444	powershell.exe
Token: SeRestorePrivilege	3444	powershell.exe
Token: SeShutdownPrivilege	3444	powershell.exe
Token: SeDebugPrivilege	3444	powershell.exe
Token: SeSystemEnvironmentPrivilege	3444	powershell.exe
Token: SeRemoteShutdownPrivilege	3444	powershell.exe
Token: SeUndockPrivilege	3444	powershell.exe
Token: SeManageVolumePrivilege	3444	powershell.exe
Token: 33	3444	powershell.exe
Token: 34	3444	powershell.exe
Token: 35	3444	powershell.exe
Token: 36	3444	powershell.exe
Token: SeDebugPrivilege	5260	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5844 wrote to memory of 624	5844	2026-08-03_f92369e9397337af0ae45b448e3251cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	88
PID 5844 wrote to memory of 4860	5844	2026-08-03_f92369e9397337af0ae45b448e3251cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 5844 wrote to memory of 264	5844	2026-08-03_f92369e9397337af0ae45b448e3251cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 5844 wrote to memory of 5192	5844	2026-08-03_f92369e9397337af0ae45b448e3251cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	95
PID 5684 wrote to memory of 3444	5684	WerFault.exe	100
PID 5684 wrote to memory of 5260	5684	WerFault.exe	102
PID 5684 wrote to memory of 4504	5684	WerFault.exe	105
PID 5684 wrote to memory of 4828	5684	WerFault.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-03_f92369e9397337af0ae45b448e3251cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_f92369e9397337af0ae45b448e3251cf_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\WER' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WerFault.exe.lnk'); $Shortcut.TargetPath = 'C:\ProgramData\Microsoft\Windows\WER\WerFault.exe'; $Shortcut.WorkingDirectory = 'C:\ProgramData\Microsoft\Windows\WER'; $Shortcut.Description = 'Windows Error Reporting Service'; $Shortcut.Save();"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4860
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "WindowsErrorReporting" /tr "C:\ProgramData\Microsoft\Windows\WER\WerFault.exe" /sc hourly /mo 2 /ru "USJNCXJL\Admin" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:264
- C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
  "C:\ProgramData\Microsoft\Windows\WER\WerFault.exe"
  2⤵
  - Executes dropped EXE
  PID:5192

C:\PROGRA~3\MICROS~1\Windows\WER\WerFault.exe
C:\PROGRA~3\MICROS~1\Windows\WER\WerFault.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\WER' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WerFault.exe.lnk'); $Shortcut.TargetPath = 'C:\ProgramData\Microsoft\Windows\WER\WerFault.exe'; $Shortcut.WorkingDirectory = 'C:\ProgramData\Microsoft\Windows\WER'; $Shortcut.Description = 'Windows Error Reporting Service'; $Shortcut.Save();"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5260
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "WindowsErrorReporting" /tr "C:\ProgramData\Microsoft\Windows\WER\WerFault.exe" /sc hourly /mo 2 /ru "USJNCXJL\Admin" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4504
- C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
  "C:\ProgramData\Microsoft\Windows\WER\WerFault.exe"
  2⤵
  - Executes dropped EXE
  PID:4828

C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
1⤵
- Executes dropped EXE
PID:4788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WerFault.exe

Path C:\ProgramData\Microsoft\Windows\WER\WerFault.exe
Size 5.8MB
SHA256 c3e202666ab5ce70778f8393ccfecc1c69e6b40a7cdf262dd89d46964d0e67bc
MD5 f92369e9397337af0ae45b448e3251cf
SHA1 6ebf2c5b0e286afcbe38956fd776fbed9a70885c
SHA512 9f808a6260eb2cc90c1180cae348805f5b1b7fc51d7e49237a08036b0bb81d3ca2e612fae100721fa55747ce42994a72cf54aa10329eaf64e076cc08a5fd6d63
SSDEEP 49152:IAo8N1CiDn/p0H/3HW/+zrJJnu+n7se14lzkZ51CXbmj5C5e26KQK1K6zfU5Em:IAJwou3J4S5X0qEm
TLSH
T1E1565B0BFC9954E5C0AE91348A729253BB717C485B2163D72B50F2283F73BD1AEBA354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

werdata.db

Path C:\ProgramData\Microsoft\Windows\WER\werdata.db
Size 184KB
SHA256 2c94719491cf270604dca5aea5655ced75f86d03dc606a08a165bf2127caf46a
MD5 a1a61800ed05c3b5c0d46a6ed42c78e4
SHA1 be58ea6102a2dcf8f578ec4542771710e0937613
SHA512 3e44b2b45f6112cf6b1bb79a95ee1e6c0f23b805b880da23172a6655e2992da7bba07e5322fcacb052f61e0281510e163b42d00e46328a2c4430752d260aaee2
SSDEEP 3072:DB2ktkta7nveM7JmJyHmH0qs1jDw01j1ZL8z8/vKTwM+65FfbdLKV/qZL0fEoWpX:DRvK5534WY8Aq
TLSH
T1AF04D9408CB9CD071CD93FBD7C9B6D011E8A538266B04907BF685A6836B45FF32DA64B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

werdata.db

Path C:\ProgramData\Microsoft\Windows\WER\werdata.db
Size 184KB
SHA256 2d6566ad9ae1ba1113a3359bbceb8dceba2e1e875be02728caf7e535568667a9
MD5 aa46abc2ec0886119959a97a4795269c
SHA1 62630290b6bdd3b56e7bbd6c970a448b7d6e567a
SHA512 31664f2078108f58209466691e0a60bcaf564dff22e4b54b12797a94ae3ef568f5c5b28406fea5c9d170de03720a18a6498650f1e997312afdabf595fdc2f970
SSDEEP 3072:Lj2ktkta7nveM7JmJyHmH0qs1jDw01j1ZL8z8/vKTwM+65FfbdLKV/qZL0fEoWLt:L/vK55T7XSwL
TLSH
T15304D8408CB5CA031CD93FBD7C976E011E9A538265B04947BB295A5836F48FF32EA74B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0aa488a62b6da6fdbdfc5e548c8bd1bd9b1e078de4877d3f5b7cd69c59b96ee1
MD5 2dd032960b8173f3fa3f9c8adf430672
SHA1 a2caa395bf47bd60cf5fd251ff1979fc840fe350
SHA512 5b26a391837d3fe9ad9c5a0e37ba07e6fc53bbd5095cb935c9f1135cd5bb43c7f6f2b2b6eabbf1747bd4c408ad8508c87322ea3e68625e6aabebf1f60f241052
TLSH
T18B115733B3CC8724DC9A403650CEAC1036B68BDB409ECE9BAB84D548B42F289CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_sou0xpn4.u1j.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sou0xpn4.u1j.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

WerFault.exe.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WerFault.exe.lnk
Size 1KB
SHA256 d082f71b3c155259b6f3e0e6967bf7a82fcd32dd17c3f0d1afc5c36fb6159f83
MD5 04476860ba42ad8252afaaf4adc20128
SHA1 5e4fbd8cad4ea0386b172445130861b3ce0230fa
SHA512 0e39b59721b3cbe7e0f5f1e2ce21fb116a8c4863fc7e05ea73b98d3062645cacf2f342a1bd5cb6ca59e2f645cbcc4d1817632c87d390390a3f43739b0c62f3cf
TLSH
T1D5219C1807F52F1BF2B681B609B627309E37F806E7A4C70A024DD1950C78A12ED78F2B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/624-9-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp

Download

memory/624-23-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp

Download

memory/624-11-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp

Download

memory/624-12-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp

Download

memory/624-16-0x00000238B9690000-0x00000238B9742000-memory.dmp

Download

memory/624-15-0x00000238A1110000-0x00000238A112E000-memory.dmp

Download

memory/624-17-0x00000238B9750000-0x00000238B975A000-memory.dmp

Download

memory/624-18-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp

Download

memory/624-19-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp

Download

memory/624-20-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp

Download

memory/624-21-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp

Download

memory/624-10-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp

Download

memory/624-0-0x00007FFCEA29F000-0x00007FFCEA2A0000-memory.dmp

Download

memory/624-8-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp

Download

memory/624-7-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp

Download

memory/624-3-0x00000238A10A0000-0x00000238A10C2000-memory.dmp

Download

memory/624-6-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp

Download

memory/624-5-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp

Download

memory/624-4-0x00007FFCEA110000-0x00007FFCEAAB4000-memory.dmp

Download

memory/3444-45-0x0000012EF72E0000-0x0000012EF7392000-memory.dmp

Download

memory/4828-56-0x0000021875950000-0x000002187597F000-memory.dmp

Download

memory/5192-34-0x000002DB613F0000-0x000002DB6141F000-memory.dmp

Download