Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
06/08/2026, 05:16
General
- Target 2026-08-06_a683882174e69b4523fcc429e961a9e2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 8.1MB
- Sample260806-fx5mlayth1
- SHA256 3e38922ae3cbffa930a94b17c6927299bbfd7209123b8ed4535286764a6cd07a
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 32 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_a683882174e69b4523fcc429e961a9e2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_a683882174e69b4523fcc429e961a9e2_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\obfuscated_miner.exe"C:\Users\Admin\AppData\Local\Temp\obfuscated_miner.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -Command "(Get-WmiObject Win32_ComputerSystem).Model"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -Command "(Get-NetAdapter | Select -ExpandProperty MacAddress) -join ','"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_j2zwvap2.2zm.ps1
obfuscated_miner.exe
memory/1324-8-0x0000000074C92000-0x0000000074C93000-memory.dmp
memory/1324-9-0x00000000005C0000-0x0000000000736000-memory.dmp
memory/1428-20-0x000001D9AF970000-0x000001D9AF98E000-memory.dmp
memory/1428-21-0x000001D9AFBC0000-0x000001D9AFC72000-memory.dmp
memory/1428-22-0x000001D9AF990000-0x000001D9AF99A000-memory.dmp
memory/1428-23-0x000001D9AFDF0000-0x000001D9AFE0E000-memory.dmp
memory/2192-12-0x00000235D1090000-0x00000235D10B2000-memory.dmp