Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 12:51
General
- Target 2026-08-03_1e3da51a9eb1e951cfe1043fe38f7d5b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 19.8MB
- Sample260804-p3kn2ser9s
- SHA256 69cfbf277c6dcaadb9044dc4af0ab1665999a76c1442a333a5469f899bc8e469
Score
10/10
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: SliverRAT
SliverRAT is an open source Adversary Emulation Framework.
- Detects DonutLoader 1 IoCs
- Sliver RAT v2 2 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_1e3da51a9eb1e951cfe1043fe38f7d5b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_1e3da51a9eb1e951cfe1043fe38f7d5b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\b.txt2⤵
- Opens file in notepad (likely ransom note)
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
b.txt
memory/4368-5-0x0000020E6D150000-0x0000020E6E2B8000-memory.dmp
memory/4368-3-0x0000020E6AD50000-0x0000020E6BE5C000-memory.dmp