e322dd663003c103e49cb629b0404a2a5e6128023a161da01c118992e9e72135

Analysis

max time kernel
148s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.0MB
Sample260808-xbeygssfrd
SHA256 e322dd663003c103e49cb629b0404a2a5e6128023a161da01c118992e9e72135
MD5 fca5e30a7904b6fa10179d4611ab5ffd
SHA1 dc1716a6a0dd174bb4284018555626597652f48d
SHA512 23a8793b4a44f9c9e090f2eef8feb04b826402a9014e7cb82deb574579e18c25684f285ac724156d12f61b324499a0deb733a254c7bcfb77f2579c47a8e1bf47
SSDEEP 98304:jkESYU6ndpptmJrz3CeaFOumvBh8huT+E:jQt6ndpXif3CFy
TLSH
T199763907ECA554E9C0AEC13189639562BF717C485B3123D32B50F6386F76BE0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution persistence

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d000000000426-5.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Executes dropped EXE 2 IoCs

pid	Process
1996	2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
1208	2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2044	powershell.exe
4556	powershell.exe
2360	powershell.exe
4412	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3076	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2044	powershell.exe
2044	powershell.exe
4556	powershell.exe
4556	powershell.exe
2360	powershell.exe
2360	powershell.exe
4412	powershell.exe
4412	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	4556	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	4412	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 3076	2688	2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 2688 wrote to memory of 1996	2688	2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 1996 wrote to memory of 2044	1996	2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 1996 wrote to memory of 4556	1996	2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 1996 wrote to memory of 2360	1996	2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	98
PID 1996 wrote to memory of 4412	1996	2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml /TN 2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3076
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4412

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Executes dropped EXE
PID:1208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
MD5 27db61c440595c38f5a7b661c618d0c9
SHA1 87613fdda39013791c068bdeec060f945fa2e908
SHA512 e367d57ce85719fa4e3cfd8083e0a5f71110b3f845c1ea7d3a0a3393066cfa90b96712701f044b731fab41ff6a751b7f4db794795c1f3aec955f642c3df25586
TLSH
T1FC115733F3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml

Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml
Size 1KB
SHA256 8c95b2a9d36902785e475c0b9cf9e65eed0c98b142f5fc44016e5da339cfc0e0
MD5 0381094c78cb1736926170afccb3217e
SHA1 4499b4bb30a7d3b30aa94ae2614f7ef41bba1da5
SHA512 3263b9eb28945af28a522fe3f6531d92049729a8b1dda9dfa6224d64a6887e3d5b08ae1befd2d9bea499cc9265cdc98ba3891ac93cdd85c231e7b7bfabdeb912
TLSH
T1E02152904C04F62BB067962ACB9117C2227EA7EA46B14139C9D80CFC748A2CB61029BB
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1vklgeyr.q0a.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1vklgeyr.q0a.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-08_fca5e30a7904b6fa10179d4611ab5ffd_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.0MB
SHA256 e322dd663003c103e49cb629b0404a2a5e6128023a161da01c118992e9e72135
MD5 fca5e30a7904b6fa10179d4611ab5ffd
SHA1 dc1716a6a0dd174bb4284018555626597652f48d
SHA512 23a8793b4a44f9c9e090f2eef8feb04b826402a9014e7cb82deb574579e18c25684f285ac724156d12f61b324499a0deb733a254c7bcfb77f2579c47a8e1bf47
SSDEEP 98304:jkESYU6ndpptmJrz3CeaFOumvBh8huT+E:jQt6ndpXif3CFy
TLSH
T199763907ECA554E9C0AEC13189639562BF717C485B3123D32B50F6386F76BE0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2044-8-0x00000267B9A50000-0x00000267B9A72000-memory.dmp

Download

memory/2044-12-0x00000267A0DD0000-0x00000267A1774000-memory.dmp

Download

memory/2360-22-0x00000222E9BE0000-0x00000222EA584000-memory.dmp

Download

memory/4412-27-0x000001C8E5C80000-0x000001C8E6624000-memory.dmp

Download

memory/4556-17-0x00000199D1200000-0x00000199D1BA4000-memory.dmp

Download