b5eee8921a53abd926ef9b6ce9ee7c38a561b404b3e0cfc90be8f71055a2e1bf

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_d9a0c33666908dc2dd4cd2b2b93397a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 15.5MB
Sample260808-3b3bnsfg62
SHA256 b5eee8921a53abd926ef9b6ce9ee7c38a561b404b3e0cfc90be8f71055a2e1bf
MD5 d9a0c33666908dc2dd4cd2b2b93397a4
SHA1 15e9e5647be9a5529b1cc698399a65f415586231
SHA512 996b82a73afb59c4e7c3b634380106daf3f0899934a7cbec477e9c8416c235cb2c577c9a86da34614984be170c5162645493b5c1d7b2607ef9b35ff7000f19bd
SSDEEP 98304:NtTCpRgcsPHMaPfe8lS7lFrQVZCuPhDDIN6aF0Hc4wwFaHgE:POzifXlSD6ZlPhDDGGvwwFaHZ
TLSH
T188F63957E96509EAC4ADC934C672D6237B713C894B3123D71B60B6247F72BD0AEBA310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4844	netsh.exe
4928	netsh.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-165825138.tmp	2026-08-08_d9a0c33666908dc2dd4cd2b2b93397a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
6	api.ipify.org
8	api.ipify.org

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-08_d9a0c33666908dc2dd4cd2b2b93397a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-08_d9a0c33666908dc2dd4cd2b2b93397a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 4844	3392	2026-08-08_d9a0c33666908dc2dd4cd2b2b93397a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 3392 wrote to memory of 4928	3392	2026-08-08_d9a0c33666908dc2dd4cd2b2b93397a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-08_d9a0c33666908dc2dd4cd2b2b93397a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_d9a0c33666908dc2dd4cd2b2b93397a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Creates a file in the Startup directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=2026-08-08_d9a0c33666908dc2dd4cd2b2b93397a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe program=C:\Users\Admin\AppData\Local\Temp\2026-08-08_d9a0c33666908dc2dd4cd2b2b93397a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4844
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=2026-08-08_d9a0c33666908dc2dd4cd2b2b93397a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\2026-08-08_d9a0c33666908dc2dd4cd2b2b93397a4_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4928