Analysis
- max time kernel
150s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/08/2026, 01:57
General
- Target 2026-08-05_7997e3a41564317dff4c78bd412ebc97_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
- Size 27.9MB
- Sample260805-cdhf6stvby
- SHA256 6f37d0f1ad0e68c2d85aa4d1ac7080c9264c0b456cb5ff1b2f390b0e5e5be276
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_7997e3a41564317dff4c78bd412ebc97_coinminer_dosia_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_7997e3a41564317dff4c78bd412ebc97_coinminer_dosia_poet-rat_quasar-rat_snatch.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_Processor | Select-Object -First 1 -ExpandProperty ProcessorId)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -Command " $macs = Get-CimInstance Win32_NetworkAdapter | Where-Object { $_.PhysicalAdapter -eq $true -and $_.MACAddress } | ForEach-Object { ($_.MACAddress -replace '[-:]', '').ToUpper() } | Where-Object { $_ -and $_ -ne '000000000000' } | Sort-Object -Unique if ($macs) { $macs | Select-Object -First 1 } "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ydnuly1z.scm.ps1
memory/5180-16-0x0000016863A10000-0x0000016863AC2000-memory.dmp
memory/5180-15-0x00000168639F0000-0x0000016863A0E000-memory.dmp
memory/5180-7-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5180-8-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5180-9-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5180-10-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5180-11-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5180-12-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5180-1-0x00007FF99F5EF000-0x00007FF99F5F0000-memory.dmp
memory/5180-6-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5180-17-0x0000016863AD0000-0x0000016863ADA000-memory.dmp
memory/5180-19-0x0000016863E70000-0x0000016863E94000-memory.dmp
memory/5180-18-0x0000016863E70000-0x0000016863E9A000-memory.dmp
memory/5180-20-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5180-21-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5180-23-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/5180-5-0x0000016863860000-0x0000016863882000-memory.dmp
memory/5180-4-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp