Analysis
- max time kernel
150s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 05:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe
- Size 31.7MB
- Sample260807-geya8sgp21
- SHA256 301605534a7886007c92aff6a56a7dad7f96a61cfca2ec90beb64f30fc049ae6
- MD5 e8947a33e29e7c2ff9a79eb06fbb979b
- SHA1 13b7d43e87a01bd1c0b46e3061901fcef021dded
- SHA512 8a62e2a95c51afb1a6d0560710a41141870a3a62676da1b07d9a31f8430a132548399c371df9c47e058c666f83edb9cfb2a0eb447a2b9f87e91d5ed0c2eea87b
- SSDEEP 196608:jw4GDAvgt+SXJfEP/ur5r/mVN/dj81QAZNkhL/uTuT2T4PJ5Utnjh:jhzvg98PWr5r/G+1dwuTuTNJ5U/
- TLSH T124775CE3F8A31A95C4EAC375C672416BBA623C190B7863D70690BB241F3ABD0D677711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2852 SecurityHealthSystray.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe" 2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe - Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org 7 api.ipify.org 10 api.ipify.org 1 ip-api.com - GoLang User-Agent 2 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 8 Go-http-client/1.1 HTTP User-Agent header 13 Go-http-client/1.1 - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2040 wmic.exe 2040 wmic.exe 2040 wmic.exe 2040 wmic.exe 1644 wmic.exe 1644 wmic.exe 1644 wmic.exe 1644 wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4684 2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe Token: SeIncreaseQuotaPrivilege 2040 wmic.exe Token: SeSecurityPrivilege 2040 wmic.exe Token: SeTakeOwnershipPrivilege 2040 wmic.exe Token: SeLoadDriverPrivilege 2040 wmic.exe Token: SeSystemProfilePrivilege 2040 wmic.exe Token: SeSystemtimePrivilege 2040 wmic.exe Token: SeProfSingleProcessPrivilege 2040 wmic.exe Token: SeIncBasePriorityPrivilege 2040 wmic.exe Token: SeCreatePagefilePrivilege 2040 wmic.exe Token: SeBackupPrivilege 2040 wmic.exe Token: SeRestorePrivilege 2040 wmic.exe Token: SeShutdownPrivilege 2040 wmic.exe Token: SeDebugPrivilege 2040 wmic.exe Token: SeSystemEnvironmentPrivilege 2040 wmic.exe Token: SeRemoteShutdownPrivilege 2040 wmic.exe Token: SeUndockPrivilege 2040 wmic.exe Token: SeManageVolumePrivilege 2040 wmic.exe Token: 33 2040 wmic.exe Token: 34 2040 wmic.exe Token: 35 2040 wmic.exe Token: 36 2040 wmic.exe Token: SeIncreaseQuotaPrivilege 2040 wmic.exe Token: SeSecurityPrivilege 2040 wmic.exe Token: SeTakeOwnershipPrivilege 2040 wmic.exe Token: SeLoadDriverPrivilege 2040 wmic.exe Token: SeSystemProfilePrivilege 2040 wmic.exe Token: SeSystemtimePrivilege 2040 wmic.exe Token: SeProfSingleProcessPrivilege 2040 wmic.exe Token: SeIncBasePriorityPrivilege 2040 wmic.exe Token: SeCreatePagefilePrivilege 2040 wmic.exe Token: SeBackupPrivilege 2040 wmic.exe Token: SeRestorePrivilege 2040 wmic.exe Token: SeShutdownPrivilege 2040 wmic.exe Token: SeDebugPrivilege 2040 wmic.exe Token: SeSystemEnvironmentPrivilege 2040 wmic.exe Token: SeRemoteShutdownPrivilege 2040 wmic.exe Token: SeUndockPrivilege 2040 wmic.exe Token: SeManageVolumePrivilege 2040 wmic.exe Token: 33 2040 wmic.exe Token: 34 2040 wmic.exe Token: 35 2040 wmic.exe Token: 36 2040 wmic.exe Token: SeDebugPrivilege 2852 SecurityHealthSystray.exe Token: SeIncreaseQuotaPrivilege 1644 wmic.exe Token: SeSecurityPrivilege 1644 wmic.exe Token: SeTakeOwnershipPrivilege 1644 wmic.exe Token: SeLoadDriverPrivilege 1644 wmic.exe Token: SeSystemProfilePrivilege 1644 wmic.exe Token: SeSystemtimePrivilege 1644 wmic.exe Token: SeProfSingleProcessPrivilege 1644 wmic.exe Token: SeIncBasePriorityPrivilege 1644 wmic.exe Token: SeCreatePagefilePrivilege 1644 wmic.exe Token: SeBackupPrivilege 1644 wmic.exe Token: SeRestorePrivilege 1644 wmic.exe Token: SeShutdownPrivilege 1644 wmic.exe Token: SeDebugPrivilege 1644 wmic.exe Token: SeSystemEnvironmentPrivilege 1644 wmic.exe Token: SeRemoteShutdownPrivilege 1644 wmic.exe Token: SeUndockPrivilege 1644 wmic.exe Token: SeManageVolumePrivilege 1644 wmic.exe Token: 33 1644 wmic.exe Token: 34 1644 wmic.exe Token: 35 1644 wmic.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4684 wrote to memory of 3204 4684 2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 91 PID 4684 wrote to memory of 1700 4684 2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 92 PID 4684 wrote to memory of 2040 4684 2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe 93 PID 2852 wrote to memory of 5348 2852 SecurityHealthSystray.exe 96 PID 2852 wrote to memory of 1644 2852 SecurityHealthSystray.exe 97 - Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 3204 attrib.exe 1700 attrib.exe 5348 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Temp\2026-08-07_e8947a33e29e7c2ff9a79eb06fbb979b_coinminer_dosia_poet-rat_quasar-rat_snatch.exe2⤵
- Views/modifies file attributes
PID:3204
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe2⤵
- Views/modifies file attributes
PID:1700
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2040
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe2⤵
- Views/modifies file attributes
PID:5348
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1644
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
- Size 31.7MB
- SHA256 301605534a7886007c92aff6a56a7dad7f96a61cfca2ec90beb64f30fc049ae6
- MD5 e8947a33e29e7c2ff9a79eb06fbb979b
- SHA1 13b7d43e87a01bd1c0b46e3061901fcef021dded
- SHA512 8a62e2a95c51afb1a6d0560710a41141870a3a62676da1b07d9a31f8430a132548399c371df9c47e058c666f83edb9cfb2a0eb447a2b9f87e91d5ed0c2eea87b
- SSDEEP 196608:jw4GDAvgt+SXJfEP/ur5r/mVN/dj81QAZNkhL/uTuT2T4PJ5Utnjh:jhzvg98PWr5r/G+1dwuTuTNJ5U/
- TLSH T124775CE3F8A31A95C4EAC375C672416BBA623C190B7863D70690BB241F3ABD0D677711
- MD5 SHA1 SHA512 SSDEEP TLSH