Analysis
- max time kernel
149s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 22:58
General
- Target 2026-08-04_586225e0a383082261ad659cdfc7b523_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 11.2MB
- Sample260804-2xt2razxcv
- SHA256 74091f5ffd3dd7ab389661d1879a58b8681aca001a53ac3ab51e431eae5e2f48
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 1 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Executes dropped EXE 4 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Drops file in Program Files directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_586225e0a383082261ad659cdfc7b523_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_586225e0a383082261ad659cdfc7b523_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\LockMeasure\agent_TCFAepAh.exeC:\Users\Admin\AppData\Roaming\LockMeasure\agent_TCFAepAh.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Mozilla\2026-08-04_586225e0a383082261ad659cdfc7b523_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exeC:\Users\Admin\AppData\Local\Mozilla\2026-08-04_586225e0a383082261ad659cdfc7b523_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Google\Chrome\Application\2026-08-04_586225e0a383082261ad659cdfc7b523_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Program Files\Google\Chrome\Application\2026-08-04_586225e0a383082261ad659cdfc7b523_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe" -4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\2026-08-04_586225e0a383082261ad659cdfc7b523_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Program Files (x86)\Microsoft\Edge\Application\2026-08-04_586225e0a383082261ad659cdfc7b523_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe" -4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
agent_TCFAepAh.exe
memory/2108-12-0x0000000002950000-0x0000000002986000-memory.dmp
memory/2108-13-0x0000000005620000-0x0000000005C6A000-memory.dmp
memory/2108-14-0x0000000005370000-0x0000000005392000-memory.dmp
memory/2108-15-0x0000000005420000-0x0000000005486000-memory.dmp
memory/2108-16-0x0000000005500000-0x0000000005566000-memory.dmp
memory/2108-19-0x0000000005E30000-0x000000000618B000-memory.dmp
memory/2108-23-0x0000000005DF0000-0x0000000005E0E000-memory.dmp
memory/2108-24-0x00000000061B0000-0x00000000061FC000-memory.dmp
memory/2108-30-0x00000000065D0000-0x0000000006618000-memory.dmp
memory/2108-31-0x00000000075B0000-0x00000000075E6000-memory.dmp
memory/2108-32-0x000000006FEA0000-0x000000006FEEC000-memory.dmp
memory/2108-33-0x00000000700A0000-0x00000000703FB000-memory.dmp
memory/2108-36-0x0000000007590000-0x00000000075B0000-memory.dmp
memory/2108-37-0x00000000075F0000-0x0000000007693000-memory.dmp
memory/2108-38-0x0000000007D70000-0x00000000083EC000-memory.dmp
memory/2108-39-0x0000000007730000-0x000000000774A000-memory.dmp
memory/2108-40-0x0000000007780000-0x000000000778A000-memory.dmp
memory/2108-41-0x0000000007890000-0x0000000007926000-memory.dmp
memory/2108-42-0x0000000007C50000-0x0000000007C72000-memory.dmp
memory/2108-43-0x00000000089B0000-0x0000000008F6A000-memory.dmp