b72bfbe52cfc7b155fb6381b10392a93db52269cd8838b913f5ce2547d108e15

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.0MB
Sample260808-px85fsxbmg
SHA256 b72bfbe52cfc7b155fb6381b10392a93db52269cd8838b913f5ce2547d108e15
MD5 95d4e82e857e9965665d4d943844236d
SHA1 fc069fd8644c5809f13dd963cbc31dd2c7c27798
SHA512 ab8a9a2915db41a71e07fbf9d1fb6bcc47a498c8b4734a228e9be38c6f5f30f41b1a400c2fc67c4ce58ced1da284f9412b248b9b6f8f66a3447c8ff6de52865a
SSDEEP 98304:Yk7SYUqn9pJ4mJx33CeaFOumvBh8huTXE:YJtqn9pOCF3CFp
TLSH
T1A4763907ECA554E9C0AEC13189639562BF717C485B3123D32B50F6386F76BE0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution persistence

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000019cb8-5.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Executes dropped EXE 2 IoCs

pid	Process
2584	2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
248	2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3524	powershell.exe
5880	powershell.exe
4532	powershell.exe
5128	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
400	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3524	powershell.exe
3524	powershell.exe
5880	powershell.exe
5880	powershell.exe
4532	powershell.exe
4532	powershell.exe
5128	powershell.exe
5128	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3524	powershell.exe
Token: SeDebugPrivilege	5880	powershell.exe
Token: SeDebugPrivilege	4532	powershell.exe
Token: SeDebugPrivilege	5128	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 400	4848	2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 4848 wrote to memory of 2584	4848	2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92
PID 2584 wrote to memory of 3524	2584	2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 2584 wrote to memory of 5880	2584	2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 2584 wrote to memory of 4532	2584	2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	98
PID 2584 wrote to memory of 5128	2584	2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml /TN 2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:400
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5128

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Executes dropped EXE
PID:248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
MD5 27db61c440595c38f5a7b661c618d0c9
SHA1 87613fdda39013791c068bdeec060f945fa2e908
SHA512 e367d57ce85719fa4e3cfd8083e0a5f71110b3f845c1ea7d3a0a3393066cfa90b96712701f044b731fab41ff6a751b7f4db794795c1f3aec955f642c3df25586
TLSH
T1FC115733F3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b4d2605b3421911dd23b203ceda3c674f6e4c59b93f9c9d10ef548e2461a3151
MD5 e6a8d33648820752b04254098d837621
SHA1 a24310e320c2b6dddfb808db69565d1ca0276e6d
SHA512 01180b5c095bfa465388173f8e0b8d234982aa4e1589058889727894e15834c54b89c46f7ba8d26582841986db1e038fbe38f813ac75419995eb7e0891a6a432
TLSH
T114115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D144B83F59ADE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 60292489db6d4ba2a3e4448639fbe7fa2261be477f63ef09bca0b55e520a4777
MD5 9db254dd0cf5e2b1153ff5cde0ed8885
SHA1 de97945a57babdd2498693fbb2b3d8bc548da209
SHA512 a86e71b1b09215d626067d2fab0d7111a5718937c4097b826e77402d32aa3bf64d73a8886104f7b0ae434dcafb9abab4d04d2c053cb65510d611c069d04f7011
TLSH
T19A115733B3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F59ADE61260
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml

Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml
Size 1KB
SHA256 fb3c35482dbbd11908dae1c9d87ae7bb989ee2ea946ef4669c4141dbc517f4c9
MD5 8e21702f83a51de1364267b1bef13c43
SHA1 05f9d70cf39f4783abe90df02d725a724292e599
SHA512 d06b9b68c00fdf96c40d57b0919f199d13cbf653528e1cf10d8d9fec24ecef1c609e56c36074bb9e17b8d2e081a152fdae2aa2b3e9636f40812403544aa8ce00
TLSH
T14A2122905C10FA1BB16B963ACB9257C2227EABE94AB14039D9CC4DFC748A2877102977
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xmun0vth.3lh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xmun0vth.3lh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-08_95d4e82e857e9965665d4d943844236d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.0MB
SHA256 b72bfbe52cfc7b155fb6381b10392a93db52269cd8838b913f5ce2547d108e15
MD5 95d4e82e857e9965665d4d943844236d
SHA1 fc069fd8644c5809f13dd963cbc31dd2c7c27798
SHA512 ab8a9a2915db41a71e07fbf9d1fb6bcc47a498c8b4734a228e9be38c6f5f30f41b1a400c2fc67c4ce58ced1da284f9412b248b9b6f8f66a3447c8ff6de52865a
SSDEEP 98304:Yk7SYUqn9pJ4mJx33CeaFOumvBh8huTXE:YJtqn9pOCF3CFp
TLSH
T1A4763907ECA554E9C0AEC13189639562BF717C485B3123D32B50F6386F76BE0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3524-10-0x000001DD207A0000-0x000001DD207C2000-memory.dmp

Download

memory/3524-12-0x000001DD208D0000-0x000001DD209FF000-memory.dmp

Download

memory/4532-22-0x000001E549140000-0x000001E54926F000-memory.dmp

Download

memory/5128-27-0x000001CE6EC20000-0x000001CE6ED4F000-memory.dmp

Download

memory/5880-17-0x0000023439170000-0x000002343929F000-memory.dmp

Download