Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/08/2026, 05:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
- Size 31.7MB
- Sample260807-geya8sgp21
- SHA256 301605534a7886007c92aff6a56a7dad7f96a61cfca2ec90beb64f30fc049ae6
- MD5 e8947a33e29e7c2ff9a79eb06fbb979b
- SHA1 13b7d43e87a01bd1c0b46e3061901fcef021dded
- SHA512 8a62e2a95c51afb1a6d0560710a41141870a3a62676da1b07d9a31f8430a132548399c371df9c47e058c666f83edb9cfb2a0eb447a2b9f87e91d5ed0c2eea87b
- SSDEEP 196608:jw4GDAvgt+SXJfEP/ur5r/mVN/dj81QAZNkhL/uTuT2T4PJ5Utnjh:jhzvg98PWr5r/G+1dwuTuTNJ5U/
- TLSH T124775CE3F8A31A95C4EAC375C672416BBA623C190B7863D70690BB241F3ABD0D677711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3488 SecurityHealthSystray.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe" 2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe - Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.ipify.org 4 api.ipify.org 17 ip-api.com - GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 28 Go-http-client/1.1 - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 2516 2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe Token: SeDebugPrivilege 3488 SecurityHealthSystray.exe Token: SeIncreaseQuotaPrivilege 4624 wmic.exe Token: SeSecurityPrivilege 4624 wmic.exe Token: SeTakeOwnershipPrivilege 4624 wmic.exe Token: SeLoadDriverPrivilege 4624 wmic.exe Token: SeSystemProfilePrivilege 4624 wmic.exe Token: SeSystemtimePrivilege 4624 wmic.exe Token: SeProfSingleProcessPrivilege 4624 wmic.exe Token: SeIncBasePriorityPrivilege 4624 wmic.exe Token: SeCreatePagefilePrivilege 4624 wmic.exe Token: SeBackupPrivilege 4624 wmic.exe Token: SeRestorePrivilege 4624 wmic.exe Token: SeShutdownPrivilege 4624 wmic.exe Token: SeDebugPrivilege 4624 wmic.exe Token: SeSystemEnvironmentPrivilege 4624 wmic.exe Token: SeRemoteShutdownPrivilege 4624 wmic.exe Token: SeUndockPrivilege 4624 wmic.exe Token: SeManageVolumePrivilege 4624 wmic.exe Token: 33 4624 wmic.exe Token: 34 4624 wmic.exe Token: 35 4624 wmic.exe Token: 36 4624 wmic.exe Token: SeIncreaseQuotaPrivilege 4624 wmic.exe Token: SeSecurityPrivilege 4624 wmic.exe Token: SeTakeOwnershipPrivilege 4624 wmic.exe Token: SeLoadDriverPrivilege 4624 wmic.exe Token: SeSystemProfilePrivilege 4624 wmic.exe Token: SeSystemtimePrivilege 4624 wmic.exe Token: SeProfSingleProcessPrivilege 4624 wmic.exe Token: SeIncBasePriorityPrivilege 4624 wmic.exe Token: SeCreatePagefilePrivilege 4624 wmic.exe Token: SeBackupPrivilege 4624 wmic.exe Token: SeRestorePrivilege 4624 wmic.exe Token: SeShutdownPrivilege 4624 wmic.exe Token: SeDebugPrivilege 4624 wmic.exe Token: SeSystemEnvironmentPrivilege 4624 wmic.exe Token: SeRemoteShutdownPrivilege 4624 wmic.exe Token: SeUndockPrivilege 4624 wmic.exe Token: SeManageVolumePrivilege 4624 wmic.exe Token: 33 4624 wmic.exe Token: 34 4624 wmic.exe Token: 35 4624 wmic.exe Token: 36 4624 wmic.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2516 wrote to memory of 4408 2516 2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 86 PID 2516 wrote to memory of 1928 2516 2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 87 PID 2516 wrote to memory of 4624 2516 2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 93 - Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 4408 attrib.exe 1928 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe2⤵
- Views/modifies file attributes
PID:4408
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe2⤵
- Views/modifies file attributes
PID:1928
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4624
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3488
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
- Size 31.7MB
- SHA256 301605534a7886007c92aff6a56a7dad7f96a61cfca2ec90beb64f30fc049ae6
- MD5 e8947a33e29e7c2ff9a79eb06fbb979b
- SHA1 13b7d43e87a01bd1c0b46e3061901fcef021dded
- SHA512 8a62e2a95c51afb1a6d0560710a41141870a3a62676da1b07d9a31f8430a132548399c371df9c47e058c666f83edb9cfb2a0eb447a2b9f87e91d5ed0c2eea87b
- SSDEEP 196608:jw4GDAvgt+SXJfEP/ur5r/mVN/dj81QAZNkhL/uTuT2T4PJ5Utnjh:jhzvg98PWr5r/G+1dwuTuTNJ5U/
- TLSH T124775CE3F8A31A95C4EAC375C672416BBA623C190B7863D70690BB241F3ABD0D677711
- MD5 SHA1 SHA512 SSDEEP TLSH