32f66022f224fe000d16cf31d1d8d06968f8ccc9ed3d86cdff40e55742887d9d

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_c5a54e1691cff91db28665ebbd29260a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 7.0MB
Sample260809-cf99zaybpe
SHA256 32f66022f224fe000d16cf31d1d8d06968f8ccc9ed3d86cdff40e55742887d9d
MD5 c5a54e1691cff91db28665ebbd29260a
SHA1 edeb0d04ed21dfbd26847c188ed3bd2e169e920a
SHA512 d5d16b6f62f541131d3da48eb26b9fe46a474cb256a67ab7167de60bba4e3a74ab86b4671ca815440523ada9687fbafb112f7e2f223d2079a7fa02649079dbb1
SSDEEP 98304:mktiYkwt4pdBWYUT3CeaFOumvBh8huTAE:mbdwt4pjnA3CFE
TLSH
T1A9763907ECA554E9C0AEC13189639562BF717C485B3123D32B50F6386F76BE0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5688	powershell.exe
5788	powershell.exe
4652	powershell.exe
1576	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5688	powershell.exe
5688	powershell.exe
5788	powershell.exe
5788	powershell.exe
4652	powershell.exe
4652	powershell.exe
1576	powershell.exe
1576	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5688	powershell.exe
Token: SeDebugPrivilege	5788	powershell.exe
Token: SeDebugPrivilege	4652	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5344 wrote to memory of 5688	5344	2026-08-09_c5a54e1691cff91db28665ebbd29260a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 5344 wrote to memory of 5788	5344	2026-08-09_c5a54e1691cff91db28665ebbd29260a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92
PID 5344 wrote to memory of 4652	5344	2026-08-09_c5a54e1691cff91db28665ebbd29260a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	94
PID 5344 wrote to memory of 1576	5344	2026-08-09_c5a54e1691cff91db28665ebbd29260a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-09_c5a54e1691cff91db28665ebbd29260a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_c5a54e1691cff91db28665ebbd29260a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 676fcf7eefd1511cad5d5c30257c1e3bac466dcff1d44f13807c0ac5587aee99
MD5 7d9c935f5e9d866da24e903a3bac57d8
SHA1 94318bffed52e690b0f7525fa5d7eae54f614885
SHA512 404b9a50bedd6af92780802674cdcda132d4a8d7feca29ef0fc59e86514e337519a0d40394e5cd55c72dc2e176fa66c56515f4a9a48f01b162d3a3745f30f401
TLSH
T10F115733B3CC8724C89A403650CEAC1136B587DB90DEDF6BBB84D148A83F59ADF61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zga0wr0d.vrf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zga0wr0d.vrf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5688-8-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5688-6-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5688-7-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5688-0-0x00007FF8BD79F000-0x00007FF8BD7A0000-memory.dmp

Download

memory/5688-9-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5688-10-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5688-11-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5688-13-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5688-14-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5688-5-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download

memory/5688-4-0x000002C0D0960000-0x000002C0D0982000-memory.dmp

Download

memory/5688-3-0x00007FF8BD610000-0x00007FF8BDFB4000-memory.dmp

Download