Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 16:38
General
- Target 2026-08-09_6da98d6b2d7e882ccadc4840ae740aed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
- Size 11.0MB
- Sample260809-t5k5tabd63
- SHA256 88e4e3b4f4e4fd06f41551160f3c4ddbd5437aabd768fc08292118f42eabadc6
Score
9/10
Malware Config
Signatures
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs
- Executes dropped EXE 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6da98d6b2d7e882ccadc4840ae740aed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_6da98d6b2d7e882ccadc4840ae740aed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\2026-08-09_6da98d6b2d7e882ccadc4840ae740aed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml /TN 2026-08-09_6da98d6b2d7e882ccadc4840ae740aed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-09_6da98d6b2d7e882ccadc4840ae740aed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-09_6da98d6b2d7e882ccadc4840ae740aed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-09_6da98d6b2d7e882ccadc4840ae740aed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-08-09_6da98d6b2d7e882ccadc4840ae740aed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-08-09_6da98d6b2d7e882ccadc4840ae740aed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch_task.xml
2026-08-09_6da98d6b2d7e882ccadc4840ae740aed_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe