Analysis
- max time kernel
148s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 22:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_675eb44b1d75ea7b804f81095c9b6fed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_675eb44b1d75ea7b804f81095c9b6fed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-04_675eb44b1d75ea7b804f81095c9b6fed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 7.2MB
- Sample260804-2tatpsfl7s
- SHA256 40b2e06f626606508aa8298435e59b1cfac4a01abecab2344d37a0f5bd2c7ce3
- MD5 675eb44b1d75ea7b804f81095c9b6fed
- SHA1 6363ead2d508884d942e9814916e2e652a4171b5
- SHA512 4489b4d3615f31a649f1c5ca44d4967297649be63a4ac2ef03a03ba891c418aae6405434408a2cae32e641700fafba2c0762d9fca18f4b30c8bc14c4fd924656
- SSDEEP 98304:Yzknz/NQTrHcnTDB1aEo/c1WhiiKX8C8x:Y+LNHn/nHh1BiKsC8x
- TLSH T1CE767D17EC5914E9D1AED13089769163BB717C881B2123D72B90F6387FB6BE0ADB9340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2860 powershell.exe 1688 powershell.exe 4304 powershell.exe 252 powershell.exe 4872 powershell.exe 4908 powershell.exe - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2256 2026-08-04_675eb44b1d75ea7b804f81095c9b6fed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 2256 2026-08-04_675eb44b1d75ea7b804f81095c9b6fed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 2256 2026-08-04_675eb44b1d75ea7b804f81095c9b6fed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 2256 2026-08-04_675eb44b1d75ea7b804f81095c9b6fed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 4908 powershell.exe 4908 powershell.exe 1688 powershell.exe 1688 powershell.exe 4872 powershell.exe 4872 powershell.exe 2860 powershell.exe 2860 powershell.exe 252 powershell.exe 252 powershell.exe 4304 powershell.exe 4304 powershell.exe 4304 powershell.exe 4872 powershell.exe 4908 powershell.exe 1688 powershell.exe 252 powershell.exe 2860 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4908 powershell.exe Token: SeDebugPrivilege 1688 powershell.exe Token: SeDebugPrivilege 4872 powershell.exe Token: SeDebugPrivilege 4304 powershell.exe Token: SeDebugPrivilege 2860 powershell.exe Token: SeDebugPrivilege 252 powershell.exe Token: SeIncreaseQuotaPrivilege 4304 powershell.exe Token: SeSecurityPrivilege 4304 powershell.exe Token: SeTakeOwnershipPrivilege 4304 powershell.exe Token: SeLoadDriverPrivilege 4304 powershell.exe Token: SeSystemProfilePrivilege 4304 powershell.exe Token: SeSystemtimePrivilege 4304 powershell.exe Token: SeProfSingleProcessPrivilege 4304 powershell.exe Token: SeIncBasePriorityPrivilege 4304 powershell.exe Token: SeCreatePagefilePrivilege 4304 powershell.exe Token: SeBackupPrivilege 4304 powershell.exe Token: SeRestorePrivilege 4304 powershell.exe Token: SeShutdownPrivilege 4304 powershell.exe Token: SeDebugPrivilege 4304 powershell.exe Token: SeSystemEnvironmentPrivilege 4304 powershell.exe Token: SeRemoteShutdownPrivilege 4304 powershell.exe Token: SeUndockPrivilege 4304 powershell.exe Token: SeManageVolumePrivilege 4304 powershell.exe Token: 33 4304 powershell.exe Token: 34 4304 powershell.exe Token: 35 4304 powershell.exe Token: 36 4304 powershell.exe Token: SeIncreaseQuotaPrivilege 252 powershell.exe Token: SeSecurityPrivilege 252 powershell.exe Token: SeTakeOwnershipPrivilege 252 powershell.exe Token: SeLoadDriverPrivilege 252 powershell.exe Token: SeSystemProfilePrivilege 252 powershell.exe Token: SeSystemtimePrivilege 252 powershell.exe Token: SeProfSingleProcessPrivilege 252 powershell.exe Token: SeIncBasePriorityPrivilege 252 powershell.exe Token: SeCreatePagefilePrivilege 252 powershell.exe Token: SeBackupPrivilege 252 powershell.exe Token: SeRestorePrivilege 252 powershell.exe Token: SeShutdownPrivilege 252 powershell.exe Token: SeDebugPrivilege 252 powershell.exe Token: SeSystemEnvironmentPrivilege 252 powershell.exe Token: SeRemoteShutdownPrivilege 252 powershell.exe Token: SeUndockPrivilege 252 powershell.exe Token: SeManageVolumePrivilege 252 powershell.exe Token: 33 252 powershell.exe Token: 34 252 powershell.exe Token: 35 252 powershell.exe Token: 36 252 powershell.exe Token: SeIncreaseQuotaPrivilege 4872 powershell.exe Token: SeSecurityPrivilege 4872 powershell.exe Token: SeTakeOwnershipPrivilege 4872 powershell.exe Token: SeLoadDriverPrivilege 4872 powershell.exe Token: SeSystemProfilePrivilege 4872 powershell.exe Token: SeSystemtimePrivilege 4872 powershell.exe Token: SeProfSingleProcessPrivilege 4872 powershell.exe Token: SeIncBasePriorityPrivilege 4872 powershell.exe Token: SeCreatePagefilePrivilege 4872 powershell.exe Token: SeBackupPrivilege 4872 powershell.exe Token: SeRestorePrivilege 4872 powershell.exe Token: SeShutdownPrivilege 4872 powershell.exe Token: SeDebugPrivilege 4872 powershell.exe Token: SeSystemEnvironmentPrivilege 4872 powershell.exe Token: SeRemoteShutdownPrivilege 4872 powershell.exe Token: SeUndockPrivilege 4872 powershell.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2256 wrote to memory of 4872 2256 2026-08-04_675eb44b1d75ea7b804f81095c9b6fed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 89 PID 2256 wrote to memory of 4908 2256 2026-08-04_675eb44b1d75ea7b804f81095c9b6fed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 90 PID 2256 wrote to memory of 2860 2256 2026-08-04_675eb44b1d75ea7b804f81095c9b6fed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 92 PID 2256 wrote to memory of 4304 2256 2026-08-04_675eb44b1d75ea7b804f81095c9b6fed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 93 PID 2256 wrote to memory of 1688 2256 2026-08-04_675eb44b1d75ea7b804f81095c9b6fed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 94 PID 2256 wrote to memory of 252 2256 2026-08-04_675eb44b1d75ea7b804f81095c9b6fed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_675eb44b1d75ea7b804f81095c9b6fed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_675eb44b1d75ea7b804f81095c9b6fed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4872
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'Dism.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionProcess 'where.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.tmp'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionExtension '.zip'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:252
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
- MD5 acbc65123954839a819fa2495d239bf7
- SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
- SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
- TLSH T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_txlkhwex.szf.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH