ce42d9e12db4f2f4d29d565919c6ce03b711769f83ce12756b8838ae195f1db8

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_2fd7ad86bf2d6b5cfdffdcbc99909514_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.0MB
Sample260808-ee9m6abe99
SHA256 ce42d9e12db4f2f4d29d565919c6ce03b711769f83ce12756b8838ae195f1db8
MD5 2fd7ad86bf2d6b5cfdffdcbc99909514
SHA1 db19b144fe63a26f808438ce400af2f0fe64a3fe
SHA512 ceba4f2f36828d1ae4a510f58c7f89bbd2a214bd604b3fcc7b5c17b7aabd81fdb0346fb9db452af7bd957ae2f26ddcb44296c24d470ea59247f75ede998df6d5
SSDEEP 98304:Ok7SYUKn9pJ4mJhJ3CeaFOumvBh8huTXE:OJtKn9pOCz3CFp
TLSH
T1D3763907ECA554E9C0AEC13189639562BF717C485B3123D32B50F6386F76BE0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution persistence

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x000600000001e6c2-6.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Executes dropped EXE 2 IoCs

pid	Process
2804	2026-08-08_2fd7ad86bf2d6b5cfdffdcbc99909514_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
380	2026-08-08_2fd7ad86bf2d6b5cfdffdcbc99909514_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4580	schtasks.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 4580	2920	2026-08-08_2fd7ad86bf2d6b5cfdffdcbc99909514_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	87
PID 2920 wrote to memory of 2804	2920	2026-08-08_2fd7ad86bf2d6b5cfdffdcbc99909514_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-08_2fd7ad86bf2d6b5cfdffdcbc99909514_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_2fd7ad86bf2d6b5cfdffdcbc99909514_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\2026-08-08_2fd7ad86bf2d6b5cfdffdcbc99909514_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml /TN 2026-08-08_2fd7ad86bf2d6b5cfdffdcbc99909514_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4580
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-08_2fd7ad86bf2d6b5cfdffdcbc99909514_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-08_2fd7ad86bf2d6b5cfdffdcbc99909514_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Executes dropped EXE
  PID:2804

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-08_2fd7ad86bf2d6b5cfdffdcbc99909514_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-08_2fd7ad86bf2d6b5cfdffdcbc99909514_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
1⤵
- Executes dropped EXE
PID:380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-08-08_2fd7ad86bf2d6b5cfdffdcbc99909514_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml

Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_2fd7ad86bf2d6b5cfdffdcbc99909514_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml
Size 1KB
SHA256 289ba4e1207175016b6f707dec93b39d0040bb5e245d82064aa1ed06d4c56a67
MD5 358a2d8e8c5c9235fba16c37b2627d65
SHA1 31ca7ada6f743f6e14561284c9e1fc581fe1c776
SHA512 6f5d6d2099c27b9fbd1870e45e5416772506cfdfe72d9c0e241a9ea6ed757d48b15dda51cc47a7cb906bbb930cb8ea380493745a9d00b53de0294c7e1224a19b
TLSH
T1452122A04C10F61BB557AA2ECB9257C2267E67AA4AB04139D9D84CBC788A1877102977
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-08_2fd7ad86bf2d6b5cfdffdcbc99909514_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-08_2fd7ad86bf2d6b5cfdffdcbc99909514_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.0MB
SHA256 ce42d9e12db4f2f4d29d565919c6ce03b711769f83ce12756b8838ae195f1db8
MD5 2fd7ad86bf2d6b5cfdffdcbc99909514
SHA1 db19b144fe63a26f808438ce400af2f0fe64a3fe
SHA512 ceba4f2f36828d1ae4a510f58c7f89bbd2a214bd604b3fcc7b5c17b7aabd81fdb0346fb9db452af7bd957ae2f26ddcb44296c24d470ea59247f75ede998df6d5
SSDEEP 98304:Ok7SYUKn9pJ4mJhJ3CeaFOumvBh8huTXE:OJtKn9pOCz3CFp
TLSH
T1D3763907ECA554E9C0AEC13189639562BF717C485B3123D32B50F6386F76BE0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads