221738006418438f0eaccf931cd47f1b2eb66475aebf53dabdc7e283989c0351

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 10.5MB
Sample260804-2m1rjssbrf
SHA256 221738006418438f0eaccf931cd47f1b2eb66475aebf53dabdc7e283989c0351
MD5 84de9904c171f065276d6171c0e109af
SHA1 137461be0375f66ddf775c8a442281eb005c91ff
SHA512 5fb4906684d67fbe61dde9b3f9f8269be0c8218b623458a7e952e6fbe3502977bdbb240439b42a9b9139ba535e574fd2b4a462d5f62b033d272435e170538f92
SSDEEP 98304:DvI62PhVeq3/aWMYZ2IPGKBunghmgDHE:DvS+2EKBug/k
TLSH
T19DB64A07EC9555E4C0AEC2318A729562BB717C494B3027D72BA0BA383FB7BD0AD79354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1824	powershell.exe
2040	powershell.exe
1120	powershell.exe
4472	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5364	asichub-monitor.exe
4468	asichub-monitor.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\AsicHubMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\AsicHub Monitor\\asichub-monitor.exe\" --tray"	reg.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
2672	taskkill.exe
1556	taskkill.exe

Modifies registry key 1 TTPs 11 IoCs

Modify Registry

T1112

pid	Process
836	reg.exe
3864	reg.exe
2620	reg.exe
3440	reg.exe
5384	reg.exe
5724	reg.exe
5184	reg.exe
1044	reg.exe
1140	reg.exe
5692	reg.exe
4608	reg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
1824	powershell.exe
1824	powershell.exe
2040	powershell.exe
2040	powershell.exe
1120	powershell.exe
1120	powershell.exe
1120	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	taskkill.exe
Token: SeDebugPrivilege	1556	taskkill.exe
Token: SeDebugPrivilege	4472	powershell.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 2672	4748	2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	88
PID 4748 wrote to memory of 1556	4748	2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 4748 wrote to memory of 3440	4748	2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 4748 wrote to memory of 5692	4748	2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	95
PID 4748 wrote to memory of 4472	4748	2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	97
PID 4748 wrote to memory of 1824	4748	2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	101
PID 4748 wrote to memory of 4608	4748	2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	103
PID 4748 wrote to memory of 5384	4748	2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	105
PID 4748 wrote to memory of 5724	4748	2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	107
PID 4748 wrote to memory of 5184	4748	2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	109
PID 4748 wrote to memory of 836	4748	2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	111
PID 4748 wrote to memory of 3864	4748	2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	113
PID 4748 wrote to memory of 1044	4748	2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	115
PID 4748 wrote to memory of 2620	4748	2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	117
PID 4748 wrote to memory of 2040	4748	2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	119
PID 4748 wrote to memory of 1120	4748	2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	122
PID 4748 wrote to memory of 1140	4748	2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	124
PID 4748 wrote to memory of 4468	4748	2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_84de9904c171f065276d6171c0e109af_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\system32\taskkill.exe
  taskkill /IM asichub-monitor.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2672
- C:\Windows\system32\taskkill.exe
  taskkill /IM hubtech-monitor.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1556
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AsicHubMonitor /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe\" --tray" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:3440
- C:\Windows\system32\reg.exe
  reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v HubTechMonitor /f
  2⤵
  - Modifies registry key
  PID:5692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$d=[Environment]::GetFolderPath('Programs');if([string]::IsNullOrWhiteSpace($d)){throw 'Pasta especial indisponivel'};$p=Join-Path $d 'AsicHub Monitor.lnk';$w=New-Object -ComObject WScript.Shell;$s=$w.CreateShortcut($p);$s.TargetPath='C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe';$s.Arguments='--tray';$s.WorkingDirectory='C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor';$s.IconLocation='C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe,0';$s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$d=[Environment]::GetFolderPath('DesktopDirectory');if([string]::IsNullOrWhiteSpace($d)){throw 'Pasta especial indisponivel'};$p=Join-Path $d 'AsicHub Monitor.lnk';$w=New-Object -ComObject WScript.Shell;$s=$w.CreateShortcut($p);$s.TargetPath='C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe';$s.Arguments='--tray';$s.WorkingDirectory='C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor';$s.IconLocation='C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe,0';$s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1824
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v DisplayName /t REG_SZ /d "AsicHub Monitor" /f
  2⤵
  - Modifies registry key
  PID:4608
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v DisplayVersion /t REG_SZ /d 0.1.13 /f
  2⤵
  - Modifies registry key
  PID:5384
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v Publisher /t REG_SZ /d Rafatech /f
  2⤵
  - Modifies registry key
  PID:5724
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v DisplayIcon /t REG_SZ /d "C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe" /f
  2⤵
  - Modifies registry key
  PID:5184
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v InstallLocation /t REG_SZ /d "C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor" /f
  2⤵
  - Modifies registry key
  PID:836
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v UninstallString /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\uninstall-asichub.exe\" --uninstall" /f
  2⤵
  - Modifies registry key
  PID:3864
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v NoModify /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:1044
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AsicHubMonitor /v NoRepair /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:2620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$d=[Environment]::GetFolderPath('Programs');if(-not [string]::IsNullOrWhiteSpace($d)){Remove-Item -LiteralPath (Join-Path $d 'HubTech Monitor.lnk') -Force -ErrorAction SilentlyContinue}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$d=[Environment]::GetFolderPath('DesktopDirectory');if(-not [string]::IsNullOrWhiteSpace($d)){Remove-Item -LiteralPath (Join-Path $d 'HubTech Monitor.lnk') -Force -ErrorAction SilentlyContinue}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1120
- C:\Windows\system32\reg.exe
  reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\HubTechMonitor /f
  2⤵
  - Modifies registry key
  PID:1140
- C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe
  "C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe" --tray
  2⤵
  - Executes dropped EXE
  PID:4468

C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe
"C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe" --tray
1⤵
- Executes dropped EXE
PID:5364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5e34248dd2cc55f37525b0f9dd7f4f19e879ad15905df49539c20497a21dd7ec
MD5 0773347dabec51061ea4a74589125e12
SHA1 05aa0df69fe48f55680b77c79ae91b5912ca48d4
SHA512 43e24bd488c61f8b8de22a5643a668863f07b523674e94c74f6ce644b8510c58e54ee8b9d45c5f99d0523501d316b9dc8d6d44360d99e1b0b0ad88182bad6669
TLSH
T12A21AB33B3CC8724CC8A403A10CEAC1032B6C7DB409ECFABBB84D544B42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

asichub-monitor.exe

Path C:\Users\Admin\AppData\Local\Programs\AsicHub Monitor\asichub-monitor.exe
Size 8.0MB
SHA256 12a98a66372a066736f382094571565f58e62918a3fa81ec3de7d50905acf527
MD5 c9ca4f8f5bbacc6c8d9a0c76c7d89577
SHA1 88519c260b76a1668eb8f55c754f3b2f841b0fef
SHA512 d2a325a722320c01057755b808c35ba24eb25bb12426b5ea63a4b91da94b5fc83c71ff101f668dc573d15f6d08fc4e5a13c58c4842ce5d480518ab5b72e57205
SSDEEP 49152:+qN4+zL5Ew5RRJitPNGtm3sOf/yBqTmgttlX9yjUWdeY2QdPq14CuxxdBy3lnnq2:+q3/aWMYZ2IPGKBunghmgDHE
TLSH
T1F3864B07EC9555E4C0AEC23186B29522BB717C495B3027D72BA0FA283F77BD0ADB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_knd32sft.kpx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_knd32sft.kpx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

secrets.bin

Path C:\Users\Admin\AppData\Roaming\AsicHub\secrets.bin
Size 390B
SHA256 1c9db2c4f9769f9f704eeb1a13c827df16ea6ec76b721d1c2fabee574d9873e3
MD5 64365e16b49db1ab2586af86f5a73329
SHA1 f1150b94668fb5b50dcaafaf4c3576ae97d21ea6
SHA512 1e272e3de9a1dd5f4cd8ae28d08ff3702c871a81d9ce244460e6ebb2797229c26761dd8bf68663e1589b036ee75266d8d131503737a9fe4cba3d620c32e9fe16
TLSH
T1F8E0F148A8A9A0C8D8484DB2DDC9A8067AC8B424DFF3C7E04E0348252036E41C23C67B
MD5 SHA1 SHA512 TLSH

Submit Download

state.json

Path C:\Users\Admin\AppData\Roaming\AsicHub\state.json
Size 82B
SHA256 efa0ac980579d325d1f73e5bd3e100c1362cecb1f4767c69a1b7e90e84a092aa
MD5 6db8812cba13eafc8df9be9629f2293d
SHA1 386a068c07d0f8d35f02fdad8476af331bdb7a57
SHA512 5d49b68fcd17c91c779f1ca4cd737e28217ab4f234e84615f84e4ec13e498db31d1868d34e4281806a62319b3f2b8dc83330c7a829aecb54743a3e876ed14714
TLSH
T19EA01120C2A80CB20CF002028028A3822830C82A088C883EA0AF00A88B2820A20300A0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4472-17-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4472-14-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4472-6-0x00007FFC242BF000-0x00007FFC242C0000-memory.dmp

Download

memory/4472-13-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4472-18-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4472-24-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4472-25-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4472-28-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4472-29-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4472-12-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4472-10-0x0000020F23680000-0x0000020F236A2000-memory.dmp

Download

memory/4472-11-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download

memory/4472-9-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp

Download