2dbc41413deb251d81be0a996fde7e517c85fbeeec6d46412df4c37170929f09

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_844b5d1ec2b52a93db8b411ca82fe3a1_coinminer_snatch.exe
Size 2.3MB
Sample260809-re2zjayhle
SHA256 2dbc41413deb251d81be0a996fde7e517c85fbeeec6d46412df4c37170929f09
MD5 844b5d1ec2b52a93db8b411ca82fe3a1
SHA1 b18238d65f998b81ee753feb35799ca24d95992c
SHA512 98b9b5ab048e233348cf0bdd41ec458a0fae4a5a02870aab346b9b35f19346b0db6a331ec5c8bf51ead4bf95b775b68ec64ab9d2c8a9121a9a33271de14fe6c8
SSDEEP 24576:x+1vRu4gSXOywD3HxmGnGQkm9QFYPOnTVMdP4aB/P1cW1OE+PVWZ80C7:x+VU4gSXOzD3HgyvWnxGKTPVl0Q
TLSH
T1D3B57C07BCA529F6C4AEA271897262827B71BC491F3123D72E90B6782F73BD05D78714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3756	Tempuqdqsnfh.exe
7096	wshelper.exe
6476	winsvc.exe
1868	wosc.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winsvc = "C:\\Windows\\system32\\winsvc.exe"	wosc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wshelper = "C:\\Windows\\system32\\wshelper.exe"	Tempuqdqsnfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winsvc = "C:\\Windows\\system32\\winsvc.exe"	wshelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winsvc = "C:\\Windows\\system32\\wosc.exe"	winsvc.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\wshelper.exe	Tempuqdqsnfh.exe
File created	C:\Windows\system32\winsvc.exe	wshelper.exe
File created	C:\Windows\system32\wosc.exe	winsvc.exe
File opened for modification	C:\Windows\system32\winsvc.exe	wosc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3756	Tempuqdqsnfh.exe
3756	Tempuqdqsnfh.exe
7096	wshelper.exe
7096	wshelper.exe
6476	winsvc.exe
6476	winsvc.exe
1868	wosc.exe
1868	wosc.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3756	Tempuqdqsnfh.exe
Token: SeDebugPrivilege	3756	Tempuqdqsnfh.exe
Token: SeDebugPrivilege	7096	wshelper.exe
Token: SeDebugPrivilege	7096	wshelper.exe
Token: SeDebugPrivilege	6476	winsvc.exe
Token: SeDebugPrivilege	6476	winsvc.exe
Token: SeDebugPrivilege	1868	wosc.exe
Token: SeDebugPrivilege	1868	wosc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 3756	4264	2026-08-09_844b5d1ec2b52a93db8b411ca82fe3a1_coinminer_snatch.exe	90
PID 3756 wrote to memory of 748	3756	Tempuqdqsnfh.exe	5
PID 7096 wrote to memory of 748	7096	wshelper.exe	5
PID 6476 wrote to memory of 748	6476	winsvc.exe	5
PID 1868 wrote to memory of 748	1868	wosc.exe	5

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:748

C:\Users\Admin\AppData\Local\Temp\2026-08-09_844b5d1ec2b52a93db8b411ca82fe3a1_coinminer_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_844b5d1ec2b52a93db8b411ca82fe3a1_coinminer_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Users\Admin\AppData\Local\Tempuqdqsnfh.exe
  C:\Users\Admin\AppData\Local\Tempuqdqsnfh.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3756

C:\Windows\system32\wshelper.exe
C:\Windows\system32\wshelper.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:7096

C:\Windows\system32\winsvc.exe
C:\Windows\system32\winsvc.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6476

C:\Windows\system32\wosc.exe
C:\Windows\system32\wosc.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ws_debug.log

Path C:\Users\Admin\AppData\Local\Temp\ws_debug.log
Size 723B
SHA256 052f3569cefbc679068009348098140f76aef3439ac8ab3e42a03139efb57a07
MD5 03233538127f1aedc373edd031ab9cb8
SHA1 c1588a59bbcfc5a2439029b0b3370118b881b150
SHA512 4f20f7d1ce37e6b2301a85fdc683655f73c648606b59db379468a69688dedfd463e4d57cc933c2be97537360401f1aecc53546fd375c972869af04b448e9d88c
TLSH
T163014C0183BD13F7AB927799D60A6EEFC382FC6531081D30639E024AB29150C8872D9B
MD5 SHA1 SHA512 TLSH

Submit Download

ws_debug.log

Path C:\Users\Admin\AppData\Local\Temp\ws_debug.log
Size 826B
SHA256 dfe39806e777649d91907c9d916d33073a94efeadf4500564315da40a765402a
MD5 f8c9ad0501ffa3612321ec3316aeccf0
SHA1 02dc40e546387ca18eedcb2c9c8e5b7d3aced62e
SHA512 5b533b08dcaf6e3bd758614ce7a68a3c88601e25bbc8a2d8d2042a37ae07d03d106660bee8fdd7a1344fb6a4686afd8a3712ed806f07f0aa1b0735381c397f86
TLSH
T169016B0183BD13F3AB937799D11A6EFFC392BC6531081D20B35E030AB2915088872D9B
MD5 SHA1 SHA512 TLSH

Submit Download

ws_debug.log

Path C:\Users\Admin\AppData\Local\Temp\ws_debug.log
Size 1KB
SHA256 4ee05b3229c37d912c45b34d03e2f71c61b2215e786d76e7fbbc6cdc86ab563e
MD5 e47fbc601a0d5ac4c2f3777671da28a5
SHA1 0af813ee81901cff5b26a9536f1aec752557b9c9
SHA512 57465da5dcb474ee4a4ecbbce71f4c809c1d584b08135c9085f9f117de77c80ab2bf2ce3973d6dbfe722ef195d33f4d5d16fe7a713b2c94141d9a618c73339bf
TLSH
T10C314D0183BD13F7EB937799921A6EEFC382FC6525081D21B39D435AB29150D8872997
MD5 SHA1 SHA512 TLSH

Submit Download

Tempuqdqsnfh.exe

Path C:\Users\Admin\AppData\Local\Tempuqdqsnfh.exe
Size 359KB
SHA256 9f51779ed26ec64c7a9a7c0b555558d4534128f2e069d0b721acc00eb2352ede
MD5 75d3a9305456b59c157146b4945b74e6
SHA1 7fc68b623412218eecbed517c0df212a1d28f936
SHA512 a1c22b7d4926c8755c39c5f80ffad320baaa023a836665c8001dddde401535b93a517d14ac328dbbcd5ffdcffbf71a64005d279efda4a29f1f157572b6a7a8e0
SSDEEP 6144:ULNW3tw6aXVpuHcFBvkNutq0Vi8bHsJE7hWZPqm74LHlHIT:w4dw6ipOcrYAiIMkoxaI
TLSH
T103746C46F7E905F8F4B7A238C9624506E7B2BC5A0770D7CF23A4465A1F236D09D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/748-14-0x000002D0B8AA0000-0x000002D0B8AA2000-memory.dmp

Download

memory/748-9-0x000002D0B8AA0000-0x000002D0B8AA2000-memory.dmp

Download

memory/3756-15-0x000001F0F8A60000-0x000001F0F8A61000-memory.dmp

Download

memory/3756-13-0x000001F0F8A40000-0x000001F0F8A41000-memory.dmp

Download

memory/3756-12-0x000001F0F8A20000-0x000001F0F8A21000-memory.dmp

Download

memory/3756-11-0x000001F0F8A10000-0x000001F0F8A11000-memory.dmp

Download

memory/3756-10-0x000001F0F8A50000-0x000001F0F8A51000-memory.dmp

Download