97d6c63e4aa507d35c498d6f2e51e3f973f949dd6213495267dbba5c787f4395

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.0MB
Sample260808-b7j2eszzct
SHA256 97d6c63e4aa507d35c498d6f2e51e3f973f949dd6213495267dbba5c787f4395
MD5 1e942eac7e20626f316d06deb57046aa
SHA1 f3093f0dc852e8174cdb1a2e502630b2e27ac920
SHA512 f9211d7d4c2942d0f873fc645082d3cedabc5f6635f98917ab0ca067470d5d358fe1fcd51059c25d209a25fda896aa41e06b4534cfc232d170dfcd368d87ce33
SSDEEP 98304:hktiYkwt4pdBWYKc3CeaFOumvBh8huTAE:hbdwt4pjn93CFE
TLSH
T114763907ECA554E9C0AEC13189639562BF717C485B3123D32B50F6386F76BE0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution persistence

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x0006000000016b3a-5.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Executes dropped EXE 2 IoCs

pid	Process
2260	2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
4976	2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1292	powershell.exe
3888	powershell.exe
3388	powershell.exe
1080	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1000	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1292	powershell.exe
1292	powershell.exe
1292	powershell.exe
3888	powershell.exe
3888	powershell.exe
3888	powershell.exe
3388	powershell.exe
3388	powershell.exe
3388	powershell.exe
1080	powershell.exe
1080	powershell.exe
1080	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	3888	powershell.exe
Token: SeDebugPrivilege	3388	powershell.exe
Token: SeDebugPrivilege	1080	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 1000	1236	2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	88
PID 1236 wrote to memory of 2260	1236	2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92
PID 2260 wrote to memory of 1292	2260	2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 2260 wrote to memory of 3888	2260	2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 2260 wrote to memory of 3388	2260	2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	98
PID 2260 wrote to memory of 1080	2260	2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml /TN 2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1000
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1080

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Executes dropped EXE
PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 147e5e696d42008f35efb5a2445233b3af34c0c91f89d62755654cc065d6d598
MD5 d2136cc5e79a18107f98932bce82d7e4
SHA1 59f3821606a3ff020b544b7bc4955dd70f2c94f6
SHA512 d789ec2189d2a328c4e9abefda4576c3fb6b0c9458e6ee0d166fe622d2a547ffa41ebdfcbc9fa0711ce97809933d648b8a3713afa7ba4b87483ed420ec249ce9
TLSH
T1E3115733B3CC8624C89A403650CEAC1036B587DB509EDF6BBB84D144B43F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml

Path C:\Users\Admin\AppData\Local\Temp\2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml
Size 1KB
SHA256 575d5006e35527c8f292a98b829ec12f4e28df4f933d2fa02312455ecdac551d
MD5 ce77ecdb27414cf029a2b13e28e09ee4
SHA1 21647a9d228c0ad282c77a11c28f833077aa9671
SHA512 4401f98408af327d6c3e75c73ce4393b46d4c0e75d444112a15681f588079154d35c311cec39269d0420faa1e8cc60427b6709fee5608f45f22ac90c783e74db
TLSH
T1492152A05C00F62FB1579A2AC7915783267E6BEA47A14038C9DC4CEC648A2CBB14297B
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mmf0dhlg.dvd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mmf0dhlg.dvd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-07_1e942eac7e20626f316d06deb57046aa_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.0MB
SHA256 97d6c63e4aa507d35c498d6f2e51e3f973f949dd6213495267dbba5c787f4395
MD5 1e942eac7e20626f316d06deb57046aa
SHA1 f3093f0dc852e8174cdb1a2e502630b2e27ac920
SHA512 f9211d7d4c2942d0f873fc645082d3cedabc5f6635f98917ab0ca067470d5d358fe1fcd51059c25d209a25fda896aa41e06b4534cfc232d170dfcd368d87ce33
SSDEEP 98304:hktiYkwt4pdBWYKc3CeaFOumvBh8huTAE:hbdwt4pjn93CFE
TLSH
T114763907ECA554E9C0AEC13189639562BF717C485B3123D32B50F6386F76BE0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1080-27-0x00000214A2B70000-0x00000214A3514000-memory.dmp

Download

memory/1292-10-0x000001D7A2D80000-0x000001D7A2DA2000-memory.dmp

Download

memory/1292-12-0x000001D78A030000-0x000001D78A9D4000-memory.dmp

Download

memory/3388-22-0x000001F45D000000-0x000001F45D9A4000-memory.dmp

Download

memory/3888-17-0x00000237FDD30000-0x00000237FE6D4000-memory.dmp

Download